Developer-Focused Supply Chain Malware via Malicious Open-Source Packages

Security researchers reported multiple software supply chain campaigns targeting developers through malicious packages in public repositories, aiming to steal credentials/secrets and establish persistent access that can later impact production environments. Socket disclosed a campaign dubbed StegaBin involving 26 malicious npm packages published over a two-day window that used a Pastebin “dead-drop” with character-level steganography to conceal C2 details, then resolved additional infrastructure across 31 Vercel deployments to deliver platform-specific shell payloads that install a RAT and a nine-module infostealer targeting VSCode data, SSH keys, git repositories, browser credential stores, clipboard contents, and other local secrets. Socket assessed the tradecraft as consistent with activity previously attributed to North Korea-aligned FAMOUS CHOLLIMA (Lazarus-linked) and noted rapid detection of the packages shortly after publication.

Separately, reporting highlighted four malicious NuGet packages—NCryptYo, DOMOAuth2_, IRAOAuth2.0, and SimpleWriter_—that targeted ASP.NET developers by exfiltrating ASP.NET Identity data (users/roles/permissions) and enabling backdoors; the packages were published in August 2024, accumulated 4,500+ downloads, and were later removed. In that campaign, NCryptYo functioned as a dropper and proxy to an attacker-controlled C2, while DOMOAuth2_ and IRAOAuth2.0 handled data theft and backdoor rule delivery, and SimpleWriter_ enabled file writing and hidden process execution while masquerading as a PDF utility. Other items in the set described unrelated C2 tooling trends (a Polygon blockchain-based botnet loader and the Vshell C2 framework) and do not describe the same package-repository supply chain incidents.