North Korean Hackers Abuse npm, GitHub, and Vercel to Spread OtterCookie Malware

The Socket Threat Research Team has uncovered a significant escalation in North Korea’s “Contagious Interview” campaign, revealing a sophisticated supply chain attack targeting the Web3 and blockchain sectors.

In a new report, researchers detailed how state-sponsored threat actors are leveraging a combined infrastructure of npm, GitHub, and Vercel to distribute the OtterCookie malware.

Since October 2025, the campaign has introduced at least 197 malicious npm packages, accumulating over 31,000 downloads.

The operation relies on social engineering, specifically fake job interviews and coding “test assignments,” to trick developers into installing compromised dependencies.

At the heart of this recent wave was a threat actor-controlled GitHub account, stardev0914, which hosted 18 repositories acting as a coherent adversarial delivery stack.

Researchers traced the attack chain back to tailwind-magic, a malicious npm package that typosquatted the legitimate tailwind-merge library.

While the package mimics standard utility functions, it contains a backdoor that triggers immediately upon installation.

Once installed, the malicious package contacts a staging endpoint hosted on Vercel (tetrismic[.]vercel[.]app).

OtterCookie Delivers Credential-Stealing Payloads

This server fetches a payload from the stardev0914 GitHub repository and executes it on the victim’s machine via a eval() function, establishing a connection to a separate Command and Control (C2) server.

This tripartite infrastructure GitHub for code hosting, Vercel for payload staging, and npm for delivery allows the attackers to rotate payloads quickly while keeping their C2 infrastructure hidden until the final stage of the attack.

The payload delivered is a new variant of the OtterCookie malware, a cross-platform Remote Access Trojan (RAT) and infostealer capable of compromising Windows, macOS, and Linux systems.

Upon execution, OtterCookie performs evasion checks to detect virtual machines or sandboxes.

Once cleared, it establishes persistence and initiates aggressive data theft, including global keylogging, multi-monitor screenshot capture, and continuous clipboard hijacking.

OtterCookie is tuned explicitly for draining digital assets. It recursively scans filesystems for seed phrases, wallet configurations, and sensitive documents.

Furthermore, it targets browser data from Chrome and Brave, specifically attempting to exfiltrate credentials and data from popular crypto-wallet extensions such as MetaMask, Phantom, and Binance Chain.

The investigation also highlighted the use of “lure” repositories. The stardev0914 account hosted cloned crypto projects, such as a fake Knightsbridge DEX front-end, which were wired to malicious dependencies like node-tailwind.

These polished, legitimate-looking templates serve as props in the fake interview process, convincing candidates to download and run the malware-laden code.

While the stardev0914 account has since been removed, the Socket Threat Research Team warns that the campaign’s techniques persist.

With new npm infiltrations appearing weekly, the “Contagious Interview” operation remains a critical threat to the developer ecosystem, turning standard development tools into vectors for sophisticated espionage and financial theft.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.