Threat reportSupply ChainTL-2026-0152
Famous Chollima (DPRK) npm Supply Chain — Pastebin Text Steganography Dead-Drop Resolver, 17 Malicious Packages, Vercel C2 Infrastructure
Famous Chollima (DPRK) npm Supply Chain (TL-2026-0152), also tracked as Contagious Interview npm Campaign, is a high-severity supply-chain compromise, first published 2026-02-27. It is attributed to WageMole (North Korea) with high confidence, affects npm npm Registry, maps to 19 MITRE ATT&CK techniques (T1027.002, T1027.003, T1036.005), and is covered by 9 detection rules and 22 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 19MITRE ATT&CK
- Actors
- 2WageMole
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 22Indicators of compromise
Key facts for TL-2026-0152
- Threat ID
- TL-2026-0152
- Also known as
- Contagious Interview npm Campaign, Famous Chollima Pastebin Steganography
- Severity
- HIGH
- Status
- MONITORING
- Category
- SUPPLY_CHAIN
- First published
- Last reviewed
- Attribution
- WageMole, Contagious Interview
- Attribution confidence
- HIGH
- Nation-state nexus
- North Korea
- Motivation
- FINANCIAL
- Target sectors
- technology, software_development, cryptocurrency, enterprise
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 22
How Famous Chollima (DPRK) npm Supply Chain works
Famous Chollima (DPRK-linked, Contagious Interview cluster) published 17 malicious npm packages (Feb 25-26, 2026) containing an identical obfuscated JavaScript loader that uses a novel text steganography technique to decode C2 URLs from seemingly benign Pastebin posts. The decoded URLs resolve to 32 Vercel-hosted C2 domains with platform-specific payloads (Linux/macOS/Windows). Part of an unusually rapid development pace — two novel loader techniques in one week (Pastebin steganography + Google Drive stager).
Famous Chollima (also known as the Contagious Interview cluster within the Lazarus Group ecosystem) deployed 17 malicious npm packages between 19:38 UTC on February 25 and 10:35 UTC on February 26, 2026 — a 15-hour burst across 12+ throwaway npm accounts. All packages contain an identical malicious JavaScript file at vendor/scrypt-js/version.js (SHA256: da1775d0fbe99fbc35b6f0b4a3a3cb84da3ca1b2c1bbac0842317f6f804e30a4).
The infection chain begins with an npm install script ('node ./scripts/test/install.js') that imports and executes the obfuscated payload. The payload implements a novel text steganography dead-drop resolver: it fetches seemingly benign text from three hardcoded Pastebin URLs (CJ5PrtNk as primary, 0ec7i68M and DjDCxcsT as fallbacks), then applies a custom decoder to extract hidden C2 URLs from specific character positions in the text. The Pastebin posts appear completely innocuous — normal English text with minor 'inexplicable typos' that actually encode the steganographic payload.
All three Pastebin posts decode to the same array of 32 Vercel-hosted domains following a consistent naming pattern: [word]-ext[NNN].vercel.app and [word]-app[NNN].vercel.app (e.g., ext-checkdin.vercel.app, cleverstack-ext301.vercel.app). Only the first domain (ext-checkdin.vercel.app) returns a 200 response, the remaining 31 serve as pre-positioned fallbacks that can be activated if the primary is taken down.
The C2 server delivers platform-specific payloads: Linux receives a bash script via /api/l that downloads tokenlinux.npl (renamed to .sh) to ~/.config/, macOS receives a bash script via /api/m that downloads to ~/Library/, Windows receives a cmd script via /api/w that downloads to %APPDATA%. All payloads execute silently with detached processes. The C2 also implements user-agent filtering — non-curl requests receive a fake 'Permanently suspended' response.
The packages typosquat popular npm libraries: daytonjs (dayjs), corstoken (cors), loadash-lint (lodash), expressjs-lint (express), fastify-lint (fastify), sequelization (sequelize), vitetest-lint (vitest), ether-lint (ethers), among others. The npm accounts use variations of 'christopher.smith', 'andrew.walker', and other Western-sounding names with Gmail addresses.
This campaign occurred alongside another novel technique the same week — Famous Chollima testing Google Drive as a malware stager via express-core-validator. Operator IP tracking via temporary email service OPSEC failures revealed consistent use of Astrill VPN and a Russian TransTeleCom IP (62.33.223.164, geolocated to Moscow), consistent with GitLab's observations of DPRK IT Worker operations.
MITRE ATT&CK techniques used in TL-2026-0152
defense-evasion
T1027.002 Software Packing; T1027.003 Steganography; T1036.005 Match Legitimate Resource Name or Location; T1070.004 File Deletion
execution
T1059.003 Windows Command Shell; T1059.004 Unix Shell; T1059.007 JavaScript; T1204.002 Malicious File
command-and-control
T1071.001 Web Protocols; T1102.001 Dead Drop Resolver; T1102.002 Bidirectional Communication; T1105 Ingress Tool Transfer
discovery
T1082 System Information Discovery
initial-access
T1195.001 Compromise Software Dependencies and Development Tools
privilege-escalation
resource-development
T1583.006 Web Services; T1585.001 Social Media Accounts; T1586.002 Email Accounts; T1608.001 Upload Malware
Affected products and versions in Famous Chollima (DPRK) npm Supply Chain
- npm — npm Registry
Vulnerable versions: 17 malicious packages published Feb 25-26 2026
Remediation for Famous Chollima (DPRK) npm Supply Chain
Immediate actions
- Audit npm dependencies for the 17 malicious packages listed in IOCs — remove immediately if found
- Search for vendor/scrypt-js/version.js in node_modules directories
- Block Pastebin URLs CJ5PrtNk, 0ec7i68M, DjDCxcsT at proxy/firewall
- Block ext-checkdin.vercel.app and all 32 decoded Vercel domains
- Hunt for Node.js processes making DNS requests to pastebin.com
- Search for tokenlinux.sh in ~/.config/ (Linux) and ~/Library/ (macOS), token.cmd in %APPDATA% (Windows)
Workarounds
- Use --ignore-scripts flag during npm install to prevent install script execution
- Pin exact dependency versions in package.json
- Use npm audit and socket.dev for supply chain monitoring
Longer-term hardening
- Implement npm package vetting and lock files (package-lock.json) in CI/CD pipelines
- Monitor for npm install scripts executing network requests to paste sites
- Deploy allowlisting for npm packages in enterprise environments
- Monitor Node.js processes spawning curl/wget as child processes
- Block temporary email domains at registration for developer platforms
Weaknesses (CWE) in Famous Chollima (DPRK) npm Supply Chain
Timeline of Famous Chollima (DPRK) npm Supply Chain
- kmsec begins tracking Famous Chollima npm publish IPs via temporary email service OPSEC failures — Astrill VPN and hide.me VPN exit IPs observed
- Famous Chollima observed publishing npm packages from Russian TransTeleCom IP 62.33.223.164 (Moscow) — used consistently through January 2026
- Three Pastebin dead-drop posts created by users davidsouza23 and Edgar04231 — contain steganographic text encoding 32 Vercel C2 URLs
- Famous Chollima publishes express-core-validator with novel Google Drive stager — first observed use of Google Drive for malware staging
- First malicious package ether-lint published at 19:38 UTC. 10 packages published within 4 hours across 7 throwaway npm accounts
- kmsec publishes analysis of Pastebin text steganography technique. Malpedia indexes the threat. Source: kmsec.uk
- Final 7 packages published between 10:05-10:35 UTC. Total: 17 packages in 15 hours. Primary Pastebin dead-drop accumulates 353 views (likely victim count)
- Threadlinqs Intelligence publishes TL-2026-0152 with full MITRE mapping, detections, and simulations
- As of 2026-05-29, the specific Feb 2026 StegaBin burst (17/26 npm packages, Pastebin dead-drop, 32 Vercel C2 nodes) is contained — packages flagged/removed within minutes and infra blocked. But Famous Chollima/Contagious Interview remains highly active: kmsec's DPRK feed logs malicious npm publishing through May 28, 2026 plus successor campaigns (PromptMink, Contagious Trader), no actor takedown.
Sources cited for Famous Chollima (DPRK) npm Supply Chain
- kmsec: Novel DPRK stager using Pastebin and text steganography
- kmsec: DPRK tests Google Drive as a malware stager
- kmsec: Tracking DPRK operator IPs over time
- kmsec: DPRK npm tracking dashboard
- Malpedia: Famous Chollima Pastebin Steganography
- GitLab: North Korean adversary operations (operator IP context)
- Open Source Malware: Contagious Interview VS Code Tasks
Detection coverage for TL-2026-0152
As of 2026-02-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0152 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.