[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fsYxz4faL32cl_2L1Ukfr7xivAt9G08BOWsolO25ouZU":3},{"article":4,"iocs":58,"watch_terms":73,"solutions":74,"lesson":163},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"7e90895c-b27f-4f39-993a-f9b2407fe9f6","Lazarus Group Uses npm Brandjacking Campaign to Target Developers","lazarus-group-uses-npm-brandjacking-campaign-to-target-developers-b1da38","North Korean Lazarus Group targets npm developers with brandjacking packages that mimic trusted tools, drop malware and put credentials at risk.","North Korea's Lazarus Group is conducting a sophisticated brandjacking campaign against npm developers, distributing dozens of malicious packages with names mimicking trusted projects like Buffer, Chai, React, and Webpack. The packages act as multi-stage droppers that deploy Node.js backdoors, collect system credentials, and establish persistent C2 access. This represents a shift in Lazarus tactics toward developer infrastructure and supply chain compromise.","Lazarus Group deploys malicious npm packages via brandjacking to target developers and steal credentials.","https:\u002F\u002Fhackread.com\u002Flazarus-group-npm-brandjacking-target-developers\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F06\u002Flazarus-group-npm-brandjacking-target-developers.jpg","2026-06-04T12:35:11+00:00","2026-06-04T14:00:20.64201+00:00",9,[17,20,23,26,29],{"name":18,"type":19},"Lazarus Group","threat_actor",{"name":21,"type":22},"Sonatype","vendor",{"name":24,"type":25},"npm","technology",{"name":27,"type":28},"Node.js","product",{"name":30,"type":31},"npm Brandjacking Campaign (Lazarus)","campaign","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":32,"icon":34,"name":35,"slug":36},null,"Malware","malware",[38,43,48,53],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":54},{"id":55,"icon":34,"name":56,"slug":57},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[59,63,67,70],{"type":60,"value":61,"context":62},"domain","www.jsonkeeper.com","Payload hosting and C2 infrastructure used by Lazarus to deliver malicious content",{"type":64,"value":65,"context":66},"ip","45.59.163.198","Command and control server associated with Lazarus npm campaign",{"type":36,"value":68,"context":69},"buffer-utilities","Brandjacked npm package (v1.0.0) that mimics legitimate Buffer library; acts as malicious dropper",{"type":36,"value":71,"context":72},"f.js","Third-stage payload delivered by compromised npm packages; executes attacker-controlled JavaScript",[21,27],{"controls":75,"vendors":157},[76,105,128],{"slug":77,"name":78,"problem":79,"products":80},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[81,89,97],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"slug":106,"name":107,"problem":108,"products":109},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[110,117,122],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":106,"product_name":114,"url":115,"description":116},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":118,"product_name":119,"url":120,"description":121},"managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":123,"product_name":124,"url":126,"description":127},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"slug":129,"name":130,"problem":131,"products":132},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[133,141,149],{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":150,"vendor_name":151,"vendor_logo":152,"product_slug":153,"product_name":154,"url":155,"description":156},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",[158],{"slug":159,"name":21,"logo_path":160,"roles":161},"sonatype","\u002Fvendor-logos\u002Fsonatype.png",[162],"reported_by",{"slug":164,"title":165,"body":166,"framework_refs":167,"framework_notes":174},"lazarus-group-exploits-developer-trust-through-npm-package-brandjacking","Lazarus Group Exploits Developer Trust Through npm Package Brandjacking","The Lazarus Group successfully compromised developer environments by uploading malicious npm packages that closely mimic legitimate, trusted libraries like React and Webpack. Developers unknowingly installed these poisoned packages, believing them to be authentic versions of popular tools, which then deployed backdoors and credential-stealing malware. This attack exploits the implicit trust developers place in package repositories and demonstrates how supply chain attacks can bypass traditional security controls by targeting the development pipeline itself. The campaign's success highlights the critical need for package verification and secure development practices in modern software workflows.",[168,169,170,171,172,173],"CIS Control 2.1","CIS Control 16.11","NIST SP 800-161","NIST SSDF SR.3.1","NIST SSDF SR.3.2","SLSA Framework Level 2",{}]