[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fJsYy5T9_q4xcfXFWICB8fVHmwY2VRQuGXbD_oGYLzNE":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":18,"status":19,"created_at":20,"published_at":21,"article":22,"tags":26,"podcasts":39,"controls":40},"baff3982-8d17-4605-b83f-2b6729f0df66","lazarus-group-exploits-developer-trust-through-npm-package-brandjacking","7e90895c-b27f-4f39-993a-f9b2407fe9f6","Lazarus Group Exploits Developer Trust Through npm Package Brandjacking","The Lazarus Group successfully compromised developer environments by uploading malicious npm packages that closely mimic legitimate, trusted libraries like React and Webpack. Developers unknowingly installed these poisoned packages, believing them to be authentic versions of popular tools, which then deployed backdoors and credential-stealing malware. This attack exploits the implicit trust developers place in package repositories and demonstrates how supply chain attacks can bypass traditional security controls by targeting the development pipeline itself. The campaign's success highlights the critical need for package verification and secure development practices in modern software workflows.","**Immediate actions:**\n- Verify package authenticity by checking publisher credentials and download statistics before installation\n- Implement package-lock files and dependency pinning to prevent unexpected package updates\n- Scan all third-party packages with security tools before integration into projects\n\n**Long-term improvements:**\n- Establish private package repositories with pre-vetted dependencies for internal development teams\n- Deploy automated dependency scanning tools in CI\u002FCD pipelines to detect malicious packages\n- Create developer training programs focused on supply chain security and package verification best practices\n\n**Detection measures:**\n- Monitor network traffic for suspicious outbound connections from development environments\n- Implement endpoint detection and response (EDR) tools on developer workstations\n- Set up alerts for unusual package installations or dependency changes in production systems",[12,13,14,15,16,17],"CIS Control 2.1","CIS Control 16.11","NIST SP 800-161","NIST SSDF SR.3.1","NIST SSDF SR.3.2","SLSA Framework Level 2",{},"published","2026-06-04T14:07:15.510628+00:00","2026-06-04T14:07:15.415+00:00",{"id":7,"url":23,"slug":24,"title":25},"https:\u002F\u002Fhackread.com\u002Flazarus-group-npm-brandjacking-target-developers\u002F","lazarus-group-uses-npm-brandjacking-campaign-to-target-developers-b1da38","Lazarus Group Uses npm Brandjacking Campaign to Target Developers",[27,33],{"id":28,"name":29,"slug":30,"description":31,"color":32},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":34,"name":35,"slug":36,"description":37,"color":38},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[41,45,49],{"slug":42,"name":43,"problem":44},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":46,"name":47,"problem":48},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",{"slug":50,"name":51,"problem":52},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship."]