INSIDE THE GITHUB INFRASTRUCTURE POWERING NORTH KOREA'S CONTAGIOUS INTERVIEW NPM ATTACKS

Summary from the TLDR InfoSec newsletter

Socket Threat Research exposed North Korea's Contagious Interview operation, which added 197 malicious npm packages since October, using a GitHub-Vercel-npm delivery chain to distribute OtterCookie malware targeting blockchain and Web3 developers through fake job interviews. The malware performs comprehensive data theft. Security teams should treat npm installs as remote code execution, implement network egress controls on CI/CD systems, require code review for GitHub templates, and deploy real-time package scanning to detect behaviors like import-time loaders and eval on network responses before malware executes.