June’s Sophisticated npm Attack Attributed to North Korea
blog.phylum.io
In June 2023, Phylum was the first to unearth a series of suspicious npm publications belonging to what appeared to be a highly targeted attack. The identified packages, published in pairs, required installation in a specific sequence, subsequently retrieving a token that facilitated the download of a final malicious payload
  • DogMuffins@discuss.tchncs.deEnglish
    0·
    2 years ago

    Whenever I hear about hackers in North Korea I always wonder how they could support a sophisticated info sec agency with advanced capabilities. I guess I just assumed there isn’t really a thriving tech community in NK from which to recruit.

    I honestly don’t know, maybe this attack is as simple as tricking a maintainer into merging a sketchy commit, and not that sophisticated?

    Or do they “purchase capability” from supporters like China or Russia?