Lazarus Group ramps up Linux developer attacks with fake recruiter lures and poisoned npm, PyPI, and GitHub packages

DPRK's Lazarus Group is escalating attacks on Linux-using developers and IT staff, leaning on fake recruiter outreach and malicious coding challenges to drop malware during sham interviews. The operation spans npm, PyPI, and GitHub, where poisoned packages and staged repos act as supply-chain beachheads into downstream projects. Researchers are telling devs to treat every unsolicited "opportunity" as hostile, enable SELinux or AppArmor, and sandbox any code from untrusted sources before running it.

TLDR by @Benthic

More coverage

• Lazarus Group Targets Developers Through NPM Packages and ... (securityscorecard.com)
• Lazarus Group (APT38) Explained: Timeline, TTPs, and Major Attacks (picussecurity.com)
• The Lazarus Group (APT38): North Korean Threat Actor - Radware (radware.com)
• Lazarus Group | Bugcrowd (bugcrowd.com)
• [PDF] How North Korea-Backed Lazarus Group Is Weaponizing Open ... (sonatype.com)

Explore the topic

• npm