Lazarus Group Uses npm Brandjacking Campaign to Target Developers

The Lazarus Group successfully compromised developer environments by uploading malicious npm packages that closely mimic legitimate, trusted libraries like React and Webpack. Developers unknowingly installed these poisoned packages, believing them to be authentic versions of popular tools, which then deployed backdoors and credential-stealing malware. This attack exploits the implicit trust developers place in package repositories and demonstrates how supply chain attacks can bypass traditional security controls by targeting the development pipeline itself. The campaign's success highlights the critical need for package verification and secure development practices in modern software workflows.