[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f7K0set-uXjmtd_gEbkCZMJYFR9ecf7BvAiNyO-GZKeI":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":55},"6bf355f9-63cb-42ed-add1-a221c603adc3","north-korean-hackers-exploit-fake-npm-packages-and-job-scams-to-compromise-30000-devices","cd9c5fd6-d930-4cd0-bf05-54f6b52eea55","North Korean Hackers Exploit Fake npm Packages and Job Scams to Compromise 30,000 Devices","The WaterPlum group exploited two compounding weaknesses: a poisoned open-source software supply chain via malicious npm packages, and social engineering that preyed on job seekers unaware of impersonation tactics. By embedding malware in packages that developers routinely trust and install, attackers gained immediate footholds on developer workstations with minimal friction. The campaign's success—30,000 devices compromised and $10.7 million stolen—demonstrates how supply chain attacks amplify reach far beyond direct targeting. Organizations that lack vetting processes for third-party packages and employees who cannot recognize recruitment-based social engineering remain critically exposed to this growing attack vector.","**Immediate actions:**\n- Audit all npm (and other package manager) dependencies in active projects against known malicious package lists and remove or replace any suspicious packages immediately.\n- Brief development and job-seeking staff on the 'Contagious Interview' campaign tactics, including fake recruiter profiles and AI\u002Fcrypto company impersonation.\n\n**Long-term improvements:**\n- Enforce a software composition analysis (SCA) tool in CI\u002FCD pipelines to automatically block or flag unvetted third-party packages before deployment.\n- Establish a curated internal package registry or allowlist to restrict developers to pre-approved, security-reviewed dependencies.\n- Integrate ongoing social engineering awareness training—including recruitment scam scenarios—into the annual security awareness program.\n\n**Detection measures:**\n- Deploy endpoint detection and response (EDR) solutions on developer workstations to identify anomalous process execution or credential access triggered by newly installed packages.\n- Monitor outbound network traffic for unusual data exfiltration patterns, especially connections to unknown cryptocurrency or AI-themed domains.",[12,13,14,15,16,17,18,19,20,21],"CIS Control 2 – Inventory and Control of Software Assets","CIS Control 14 – Security Awareness and Skills Training","NIST SP 800-161 – Supply Chain Risk Management","NIST SP 800-218 – Secure Software Development Framework (SSDF) – PW.4 (Reuse Well-Secured Software)","NIST CSF ID.SC-3 – Suppliers and third-party partners are assessed","NIST AT-2 – Literacy Training and Awareness","NIST SA-12 – Supply Chain Protection","SLSA Framework – Level 2+ for package provenance verification","OpenSSF Scorecard – Dependency risk evaluation for open-source packages","GDPR Article 32 – Security of processing (relevant for EU organizations whose data was exfiltrated)",{},"published","2026-09-19T18:20:35.667096+00:00","2026-09-19T18:20:35.553+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fnorth-korean-waterplum-hackers-infected-30-000-devices-worldwide\u002F","north-korean-waterplum-hackers-infected-30-000-devices-worldwide-f02d07","North Korean WaterPlum hackers infected 30,000 devices worldwide",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":38,"name":39,"slug":40,"description":41,"color":42},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[44,50],{"id":45,"date":46,"edition":47,"title":48,"audio_url":49},"732234ef-c419-4448-89e9-32fe9ffdd930","2026-09-21","morning","ThreatNoir Morning Brief — September 21","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-09-21\u002Fthreatnoir-morning-brief-2026-09-21.mp3",{"id":51,"date":52,"edition":47,"title":53,"audio_url":54},"4750d5e8-be58-4807-aa15-baab6990c46c","2026-09-20","ThreatNoir Weekend Brief — September 20","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-09-20\u002Fthreatnoir-morning-brief-2026-09-20.mp3",[56,60,64],{"slug":57,"name":58,"problem":59},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":61,"name":62,"problem":63},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",{"slug":65,"name":66,"problem":67},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship."]