Poisoned Pipeline

Poisoned Pipeline / Incidents / AS41

AS41 · 2023-01

DPRK Contagious Interview (BeaverTail / npm + git)

npmPyPIGit / GitHubVS Code / IDE

OpenSourceMalware’s 2026 analysis of Lazarus Group’s Contagious Interview
campaign (tracked since 2023): fake recruiters on LinkedIn, Fiverr and
Upwork send developers a “coding test” that is malware. Delivery includes
npm packages (e.g. tailwindcss-forms-kit), git repos, and PyPI. OSM was
tracking 373 npm packages, 405 git repos, 988 threats and 4285 IOCs for
this cluster. Later waves hid loaders in VS Code tasks and fake fonts.

Mapped techniques

supply-chain Fake-recruiter delivery

T0129 · Initial Access · Typosquatting

Packages named like legitimate developer utilities (tailwindcss-forms-kit).

T0109 · Resource Development · Publish malicious artifact

Hundreds of npm (and PyPI) packages plus git repos as droppers.

T0197 · Initial Access · Use code from untrusted source

Victims were asked to clone or npm-install the “interview” project.

T0154 · Initial Access · Malicious IDE extension

Later waves abused VS Code tasks.json and fake font/dictionary files.

post-supply-chain Developer workstations

T0159 · Execution · Malicious artifact execution

npm install / running the test executed BeaverTail-class stealers.

T0139 · Impact · Resource hijacking

Crypto-wallet theft and persistent backdoors on developer machines.

Sources