[123rf]
[123rf]

A North Korean hacking group that stole roughly 1 trillion won ($643 million) in virtual assets from around the world in the first half of this year alone has now been found distributing fake software packages through an official repository used by developers worldwide — a so-called supply chain attack designed to compromise entire companies by impersonating trusted code.

JFrog's security research lab, based in Silicon Valley, said Friday (local time) it had discovered six malicious packages in npm, the official software repository for JavaScript developers, each crafted to closely mimic widely used code libraries.

The attack exploits a common developer practice of downloading shared, ready-made code from public repositories rather than writing every function from scratch. Much like a carpenter buying standard nails from a hardware store, the hackers copied popular packages downloaded more than 1.2 million times a month and quietly embedded malicious code inside them.

The group also exploited the habit of developers typing only partial package names when searching. Instead of the legitimate "rollup-plugin-polyfill-node," the fake packages bore similar-sounding names such as "rollup-packages-polyfill-core" and "rollup-runtime-polyfill-core." Internal documentation and homepage links were copied verbatim from the originals, making the counterfeits virtually impossible to distinguish by sight.

The evasion techniques were equally sophisticated. The malicious code lay dormant if it detected a sandbox environment used for security analysis. The core payload was not embedded in the package itself — it was downloaded covertly from an external source only at the moment of installation or execution, a multi-stage approach that makes the package appear clean under standard inspection.

Rather than targeting ordinary internet users, the hackers used developers' computers — the machines used to build corporate systems — as a stepping stone. The ultimate goal, researchers believe, was to monitor screens, seize control of those machines, and ultimately steal cryptocurrency wallets and login credentials held by the companies those developers work for.

JFrog's security lab said the multi-stage structure and disguise techniques used in the attack match the known methods of Lazarus, a hacking group the US government has designated as linked to North Korea. Lazarus is one of three major hacking organizations under North Korea's Reconnaissance General Bureau, alongside Kimsuky and Andariel.

North Korean hacking groups have been stepping up their theft of virtual assets across the board. According to blockchain analytics firm TRM Labs, North Korea stole assets worth about 1 trillion won — approximately $700 million — in the first half of this year alone, accounting for 66 percent of all cryptocurrency hack losses globally during that period.

The groups previously stole Ethereum from South Korea's largest cryptocurrency exchange, and in November last year struck again, hacking a domestic exchange for 44.5 billion won worth of Solana-based assets using the same methods, drawing international notoriety. Their tactics have since evolved beyond directly targeting coins — as the npm case illustrates, they are now infiltrating the development supply chain infrastructure of companies themselves.

Some of the fake packages have since been taken down from the repository under emergency sanctions. JFrog's research team warned that "North Korean hackers are penetrating deeper into infrastructure" and urged any developer or company that had already installed the packages to thoroughly check for signs of compromise.


attom@heraldcorp.com