Skip to content

DPRK npm/developer-ecosystem supply-chain scale-up

Signal card · maintained from public sources · last updated 2026-10-05

CategoryThreat-Actor Behaviour
StatusStrengthening
Confidence🟩
First observed2026-08-09
Last updated2026-10-05

Overview

DEF CON 34 presenters (2026-08-09) described DPRK actors running what they characterized as the largest npm-ecosystem supply-chain campaign to date, against a registry serving 1.7B+ downloads/week. Seeded to the watchlist as a single-event observation. Recurrence mining on 2026-09-29 surfaced two independent, named-CTI-vendor reports that predate but substantively corroborate the same underlying pattern: DPRK actors running developer-ecosystem/package-registry poisoning at multi-hundred-package, multi-registry scale, not a one-off stunt. Promoted on that corroboration — the specific "watch for" condition the seed entry named (named-vendor CTI reporting confirming campaign continuity).

Evidence log

  • 2026-08-09 — DEF CON 34 presenters describe DPRK actors running the largest npm-ecosystem supply-chain campaign observed to date, against a registry serving 1.7B+ downloads/week. Single-event, unnamed-vendor conference talk. DEF CON 34 · TechTimes
  • 2026-07 (found 2026-09-29, predates the seed but independently corroborates it) — Socket's "PolinRider" report: 108 malicious packages / 162 release artifacts across npm (19), Packagist/Composer (10), Go modules (61) and one Chrome extension, attributed to DPRK's Contagious Interview / Famous Chollima cluster; campaign running since December 2025, using compromised GitHub repos to plant loaders leading to the DEV#POPPER RAT and OmniStealer. Multi-registry, not npm-only. Socket · The Hacker News
  • 2026-07-31 (found 2026-09-29, predates the seed but independently corroborates it) — AWS's own named attribution (medium confidence) ties the axios (Mar 2026), debug and chalk (Sep 2025) and typo-crypto (Mar 2025) npm package compromises to a DPRK-linked actor tracked as SAPPHIRE SLEET / STARDUST CHOLLIMA / BlueNoroff / CageyChameleon / Alluring Pisces — a compromised maintainer account via social-engineering/lookalike-domain phishing, not a stolen-credential mass campaign. Malicious debug/chalk versions reportedly reached ~10% of cloud environments before detection (debug: ~300M weekly downloads; chalk: ~700M). First-party hyperscaler attribution, not a third-party security vendor — first time these compromises were publicly tied to this actor. AWS Security Blog · The Hacker News

  • 2026-09-09 (disclosed ~2026-09-22) — CloudSEK discloses GHAPPIER — the first named post-Sep-2026 package wave, satisfying this card's own stated confidence gap. An attacker used the maintainer account of npm package @dforge-core/dforge-mcp for 105 minutes on Sep 9, publishing a malicious release (v0.2.21) via npm's "trusted publishing" mechanism — valid cryptographic provenance, no stolen token needed. The loader (previously unreported, dubbed GHAPPIER) spans at least 65 GitHub repositories, 73 infected files, and 22 accounts. A second payload family found in another victim's repository carries the exact signature CloudSEK ties to PolinRider (the DPRK-linked campaign already in this card's evidence base): a dead-drop C2 technique writing to a 20-byte recipient address via a ~$0.20 empty Ethereum transaction — "a channel with no domain to suspend, no host to seize and no account to disable." CloudSEK · Infosecurity Magazine

  • 2026-08-20/2026-09-19 (found 2026-10-05) — Famous Chollima (Contagious Interview) runs a continuous publishing cadence through September: Socket data shows 53 malicious npm releases across 33 distinct packages in this four-week window, the freshest confirmed activity window to date for this cluster — continuity after the Sep-9 GHAPPIER finding, not a one-off resurgence. Dark Reading

Assessment

Confidence: 🟩 High. Three independent, named CTI sources (Socket, AWS, and now CloudSEK) now confirm this as an ongoing, evolving campaign rather than a fixed set of incidents. CloudSEK's Sep 2026 GHAPPIER finding is a new loader family and new technique (npm "trusted publishing" abuse plus on-chain dead-drop C2) appearing after this card's opening evidence base, tied by payload signature to the same PolinRider lineage Socket and AWS already attributed to DPRK. This is exactly the missing piece the prior assessment named: a single vendor tracking campaign continuity over time (new package waves after Sep 2026, not just the Jul 2026 batch already known). Upgraded from 🟨 Moderate.

Estimate: Likely that DPRK-linked developer-ecosystem poisoning continues to scale in package count and registry coverage over the next two quarters, given three independent sources (DEF CON, Socket, AWS) now describe the same pattern at increasing scale through mid-2026. Roughly even chance a major registry ships a structural countermeasure (mandatory publisher verification, provenance attestation) directly citing DPRK-attributed campaigns as the trigger, rather than a generic supply-chain-hardening initiative.

Review note (2026-10-05): Fresh evidence (Famous Chollima, 53 releases/33 packages, Aug 20-Sep 19) confirms campaign continuity through the most recent confirmed window but does not itself clear a graduation bar — this is more of the same pattern at the same registry (npm), not a new registry mix or a structural countermeasure from a registry operator. No status or confidence change; still 🟩 High + Strengthening. Next graduation verdict due after ≥30 days at this status (card has been at 🟩 High since 2026-09-29, so due around 2026-10-29 absent an earlier qualifying event).

Review note (2026-10-15): Checked for a new named package wave or registry countermeasure; found nothing dated in the last week beyond material already in this evidence log. No status or confidence change. Graduation verdict still due ~2026-10-29.

Graduation verdict (2026-10-30, SIG-12): Card has now held 🟩 High + Strengthening for ≥30 days (since 2026-09-29). Checked all three named "Watch for" conditions directly: no new post-Sep-2026 package wave beyond the already-logged GHAPPIER/Famous Chollima activity, no registry operator (npm/GitHub, PyPI, crates.io) citing DPRK-attributed campaigns when announcing new publisher-verification or provenance requirements, and no shift in target registry mix to a first large-scale PyPI/crates.io wave. Not graduating. Stays Strengthening — the pattern is well-corroborated but not yet the mainstream/ordinary-coverage inflection that graduated vibe-coding or ai-labor-cost-backlash; none of the specific watched events has fired. Re-check at next signal-review.

Watch for: a new named package wave (post-Sep 2026) attributed to the same DPRK clusters (Contagious Interview, SAPPHIRE SLEET, STARDUST CHOLLIMA, BlueNoroff, Alluring Pisces); a registry operator (npm/GitHub, PyPI) citing DPRK-attributed campaigns specifically when announcing new publisher-verification or provenance requirements; a shift in target registry mix (e.g. a first large-scale PyPI or crates.io wave, not just npm/Packagist/Go).

Portfolio relevance: Any portfolio company with a modern software supply chain depends on these registries as unaudited third-party infrastructure; DPRK's revenue motive (crypto theft via compromised developer machines and CI credentials) makes this a durable rather than opportunistic threat, distinct from typical opportunistic typosquatting.

Sources

← All signals