Lazarus Expands Malicious npm Campaign: 11 New Packages Add Malware Loaders and Bitbucket Payloads

Author(s): Socket
Organization: Socket

Open article directly Open article on Archive.org

2026-07-28 ⋅ Socket ⋅ Socket Research Team
Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan
JADESNOW

2026-07-01 ⋅ Socket ⋅ Karlo Zanki
PolinRider: North Korea-Linked Supply Chain Campaign Expands Across Open Source Ecosystems
JADESNOW

2026-06-07 ⋅ Socket ⋅ Socket
Shai-Hulud Descends to Hades: Miasma Worm Campaign Spreads with New PyPI Wave
Shai-Hulud

Propose Change Lazarus Expands Malicious npm Campaign: 11 New Packages Add Malware Loaders and Bitbucket Payloads