North Korean Hackers Steal Developer Credentials to Inject Malware Into GitHub and Software Packages
North Korean DeceptiveDevelopment group steals developer credentials to inject malware into GitHub and software
A North Korea-aligned hacking group called DeceptiveDevelopment has escalated from fake job interview lures to stealing developer credentials and injecting malware directly into trusted GitHub repositories and software packages (npm, PyPI, Go, Packagist) between April and September 2026. The attackers use stolen Git credentials and SSH keys to add malicious code to repositories, then hide their changes by rewriting commit history. The compromised packages distribute malware including OmniStealer (infostealer) and DEV#POPPER (remote access trojan) to downstream users, while using blockchain-based command-and-control infrastructure to evade takedown.
AI summary of the linked source. Not reviewed by an editor. How this works
Run VS Code?
Get an email when a new story names VS Code, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonDeceptiveDevelopment compromised developer Git credentials and SSH keys — likely harvested through fake job lures — to inject malware directly into trusted open-source repositories on GitHub, npm, PyPI, Go, and Packagist. By rewriting commit history, attackers erased forensic evidence of their tampering, making detection extremely difficult for both maintainers and downstream consumers. This is a textbook software supply chain attack: once a trusted package is poisoned, every developer or system that installs it becomes a victim without ever interacting with the attacker directly. The use of blockchain-based C2 infrastructure further complicates takedown efforts, extending the window of compromise. This incident underscores that developer credentials are high-value targets and that implicit trust in public repositories is a dangerous assumption.
What helps against this
How we list vendors
- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — OmniStealer
- malware — DEV#POPPER
- malware — NullReceive