The North Korean threat actors behind the ongoing Contagious Interview campaign are expanding their tentacles on the npm ecosystem by distributing more malicious packages including the BeaverTail malware and a new remote access trojan (RAT) loader.
"These latest samples employ hexadecimal string encoding to evade automated detection systems and manual code audits, signaling a variation in the threat actors' obfuscation techniques," Socket security researcher Kirill Boychenko noted in a report.
The following packages were downloaded over 5,600 times before being removed: empty-array-validator, twitterapis, debugger-vite, snore-log, core-pino, events-utils, icloud-cod, cln-logger, node-clog, and consolidate-log.
The announcement comes nearly a month after six npm packages were discovered to be distributing BeaverTail, a JavaScript stealer that can also deploy a Python-based backdoor known as InvisibleFerret. The campaign's ultimate purpose is to breach developer systems using the premise of a job interview, steal sensitive data, syphon financial assets, and maintain long-term access to compromised networks.
The newly discovered npm packages masquerade as utilities and debuggers, with one of them - dev-debugger-vite - utilising a command-and-control (C2) address previously identified by SecurityScorecard as being used by the Lazarus Group in a campaign called Phantom Circuit in December 2024.
What distinguishes these packages is that some of them, like events-utils and icloud-cod, are connected to Bitbucket repositories rather than GitHub. Furthermore, the icloud-cod package was discovered to be located in a directory called "eiwork_hire," confirming the threat actor's usage of interview-related themes to activate the infection.
An investigation of the packages, cln-logger, node-clog, consolidate-log, and consolidate-logger, revealed slight code-level differences, indicating that the attackers are publishing numerous malware variants to boost the campaign's success rate.
Regardless of the alterations, the malicious code encoded in the four packages acts as a remote access trojan (RAT) loader, capable of spreading a next-stage payload from a remote server. Cybersecurity expert Boychenko stated that the exact nature of the malware being disseminated via the loader is unknown at this time due to the C2 endpoints no longer serving payloads.
"The code functions as an active malware loader with remote access trojan (RAT) capabilities," Boychenko noted. "It dynamically fetches and executes remote JavaScript via eval(), enabling North Korean attackers to run arbitrary code on infected systems. This behavior allows them to deploy any follow-up malware of their choosing, making the loader a significant threat on its own.”
The findings highlight the persistent nature of Contagious Interview, which, in addition to posing a long-term threat to software supply chains, has adopted the infamous ClickFix social engineering approach to propagate malware.
The discovery of the new npm packages comes as South Korean cybersecurity firm AhnLab outlined a recruitment-themed phishing effort that downloads BeaverTail, which is subsequently used to launch a previously undocumented Windows backdoor known as Tropidoor. The firm's analysis of data shows that BeaverTail is actively targeting developers in South Korea.