North Korean supply chain attacks go industrial: npm, GitHub actions, and the new era of developer espionage

Recent sophisticated npm supply chain attacks have shifted from traditional install-time hooks to import-time code execution, exploiting the node-gyp rebuild process and module loading to trigger heavily obfuscated payloads that evade npm v12’s script-blocking defenses. Campaigns like Miasma and those linked to North Korea’s Lazarus Group embed malicious code that activates upon require() or import, enabling stealthy execution during developer builds or CI jobs rather than during installation, thereby bypassing common mitigations such as npm install --ignore-scripts.

These attacks employ complex multi-stage malware deployment chains, often involving encrypted payloads fetched from decentralized platforms like IPFS, which are then decrypted and executed to establish persistent, modular botnets. For example, the Miasma campaign uses a Bun JavaScript runtime loader retrieved from GitHub and an encrypted 8.25 MB bundle from IPFS that implements a cross-platform botnet with advanced command-and-control channels including Nostr, Ethereum, and BitTorrent DHT, enabling resilient persistence and stealthy propagation across developer and CI/CD environments.

Exploitation of GitHub Actions workflows represents a critical vector for persistent credential theft and stealthy propagation, with attackers injecting malicious AI assistant and IDE configuration files into repositories and chaining multiple workflow files to escalate privileges. These workflows abuse features like pull_request_target events to execute attacker-controlled code with repository secrets, enabling unauthorized package publishing with valid cryptographic provenance and persistent non-expiring credentials, as seen in attacks against AsyncAPI and Microsoft’s Azure Sentinel repositories.

Credential harvesting in these campaigns is extensive and sophisticated, targeting environment variables, cloud metadata endpoints, and even scraping process memory to bypass secret masking in GitHub Actions. The malware collects secrets across major cloud providers and vaults—including AWS, GCP, Azure, HashiCorp Vault, and 1Password—facilitating automated cross-ecosystem propagation by republishing compromised npm packages with forged provenance and creating attacker-controlled GitHub repositories for command-and-control and data exfiltration, exemplifying a highly stealthy and persistent supply chain threat.

The North Korean state-sponsored PolinRider campaign, orchestrated by Lazarus Group and APT37, represents a sophisticated escalation in supply chain attacks targeting a broad spectrum of open-source ecosystems including npm, Packagist, Go modules, and Chrome extensions. By mid-2026, the campaign had published over 108 malicious packages and extensions, leveraging obfuscated JavaScript loaders hidden in configuration files like vite.config.js and .vscode/tasks.json to execute multi-stage payloads that steal credentials and enable lateral movement within developer and CI/CD environments. This multi-ecosystem approach not only complicates detection but also underscores the persistent threat posed to individual developers and organizations relying on automated pipelines ingesting public dependencies.

A hallmark of these North Korean campaigns is their use of novel infection vectors that evade conventional security measures, such as import-time code execution in npm packages mimicking legitimate Rollup polyfills. Unlike traditional install-time attacks, these payloads execute malicious code the moment a developer imports the package, bypassing npm v12’s new default blocking of lifecycle scripts. This stealth is further enhanced by multi-stage delivery methods involving Base64-encoded npm install commands and dynamic retrieval of encrypted payloads from blockchain RPC endpoints like TRON and BNB Smart Chain, decrypted in-memory to avoid static analysis and sandbox detection.

Operational security and deception are central to the attackers’ strategy, as evidenced by their manipulation of git history through force-pushes and anti-dated commits to obscure malicious modifications in legitimate GitHub repositories. They also employ sophisticated repository cloning tactics, creating new repos with decade-old commit histories to masquerade as mature open-source projects, thereby gaining developer trust. Additionally, the campaigns exploit VS Code’s auto-run features by embedding malicious tasks that execute code immediately upon folder opening without user interaction, facilitating credential theft and persistent backdoor access via malware families like BeaverTail and OtterCookie, which are part of the Contagious Interview and Famous Chollima clusters.

Beyond technical sophistication, these campaigns reveal a hybrid operational model involving real and stolen identities, including verified LinkedIn recruiters and developers from Colombia and Argentina, suggesting coerced or complicit insiders facilitating supply chain infiltration. The scale of these operations is vast, with over 1,700 poisoned packages tracked across five registries and 338 malicious npm packages alone amassing more than 50,000 downloads. Moreover, the monetization of such campaigns is exemplified by a $17 million fraud scheme involving a 'laptop farm' in Arizona, enabling North Korean workers to impersonate employees at over 300 U.S. companies, highlighting the intersection of cyber espionage and financial crime.

The supply chain threat landscape has evolved into a highly industrialized and multifaceted battleground where attackers exploit trusted developer workflows and ecosystems beyond npm, including PyPI and NuGet. Microsoft’s attribution of over 60 malicious npm packages to North Korean group Sapphire Sleet, alongside Polymarket’s $3 million loss from a compromised third-party JavaScript component, underscores the severe erosion of developer trust models. This shift is further evidenced by campaigns like Shai-Hulud Miasma and Atomic Arch that leverage dependency confusion and maintainer hijacking, transforming familiar package names and trusted distribution channels into potent attack vectors across multiple ecosystems.

Emerging supply chain attacks increasingly target privileged credentials within AI development tools and IT management software, expanding the attack surface well beyond traditional developer artifacts. For instance, the Amazon Q Developer vulnerability silently exfiltrated AWS credentials upon repository access, while the Iranian APT Cavern Manticore exploited the SysAid update mechanism to deploy modular Cavern C2 malware with advanced anti-analysis features, enabling persistent espionage against Israeli organizations. These sophisticated campaigns leverage encrypted, obfuscated command-and-control communications and lateral movement techniques, illustrating how supply chain compromises now facilitate deep infiltration into complex organizational environments.

The rapid rise of targeted supply chain attacks reflects a strategic pivot from broad malware campaigns to precision strikes on developers and trusted software components, with 75-fold growth in targeted malicious package campaigns over two years. Attackers increasingly execute code during package installation—62% of AI-era malicious packages analyzed do so—to steal credentials early and compromise developer environments before code reaches production. Advanced stealth techniques now appear in over 25% of malicious packages, complicating detection and investigation, as highlighted by Brian Fox of Sonatype who emphasizes the urgent need for trusted intelligence to navigate the evolving AI-driven software development paradigm.

Supply chain compromises are frequently enabled by stolen GitHub credentials and publishing tokens, allowing attackers to swiftly inject malware into widely used packages—even those from security vendors like Jscrambler. The Injective breach exemplifies this trend, where a malicious commit from a legitimate contributor account led to runtime credential theft that evaded common defenses such as the --ignore-scripts flag, with exfiltration cleverly hidden in HTTP headers disguised as telemetry. These incidents highlight systemic vulnerabilities in development and CI/CD toolchains that transcend blockchain-specific threats, emphasizing the fragility of developer trust models in the face of sophisticated evasion and propagation tactics.

Traditional static and dynamic analysis tools fall short in detecting sophisticated vulnerabilities within CI/CD pipelines, particularly when malicious activity spans multiple GitHub Actions workflows. As highlighted in the 2026 GitHub Actions attack analysis, each individual YAML workflow file appears valid and passes standard SAST or DAST scans, yet their combined execution enables complex privilege escalations and secret exposures that evade detection. This blind spot is exacerbated by malware employing import-time code execution and obfuscation techniques, as seen in the AsyncAPI compromise, which bypasses typical install-time defenses like npm's --ignore-scripts flag.

The exploitation of trust models inherent to GitHub Actions workflows, especially those triggered by pull_request_target and workflow_run events, presents a critical security challenge. These workflows run with elevated privileges and access to sensitive secrets, including non-expiring GitHub App keys and broad GITHUB_TOKEN permissions, allowing attackers to execute arbitrary code and persistently compromise CI/CD environments. The AsyncAPI incident demonstrated how a misconfigured workflow that checked out untrusted pull request code in a privileged context enabled credential theft and unauthorized package publishing, underscoring the dangers of overly permissive CI/CD configurations.

Advanced malware targeting CI/CD pipelines has evolved to detect its execution environment and leverage complex persistence and lateral movement strategies, complicating detection and remediation efforts. The multi-stage Miasma botnet uncovered in the AsyncAPI attack utilized decentralized fallback channels across platforms like Nostr, Ethereum, and IPFS, enabling resilient command and control within developer and build environments. This sophistication demands security solutions beyond traditional static analysis, such as behavioral monitoring tools like Microsoft Defender for Endpoint, which can identify suspicious Node.js processes and network activity indicative of such advanced threats.

A significant challenge in defending CI/CD pipelines lies in organizational awareness and timely remediation of vulnerabilities. The AsyncAPI compromise exploited a security fix that remained unmerged for 58 days, illustrating how delays in patching known workflow misconfigurations can leave pipelines exposed to credential theft and supply chain attacks. Moreover, many corporate security teams underestimate the impact of these threats, mistakenly assuming that private repositories or lack of public code reduces risk, despite insider threats and automation trust boundaries enabling persistent compromise.