Famous Chollima (DPRK) npm Supply Chain — Pastebin Text Steganography Dead-Drop Resolver, 17 Malicious Packages, Vercel C2 Infrastructure
Famous Chollima (DPRK) npm Supply Chain (TL-2026-0152), also tracked as Contagious Interview npm Campaign, is a high-severity supply-chain compromise, first published 2026-02-27. It is attributed to WageMole (North Korea) with high confidence, affects npm npm Registry, maps to 19 MITRE ATT&CK techniques (T1027.002, T1027.003, T1036.005), and is covered by 9 detection rules and 22 indicators of compromise.
Key facts for TL-2026-0152
- Threat ID
- TL-2026-0152
- Also known as
- Contagious Interview npm Campaign, Famous Chollima Pastebin Steganography
- Severity
- HIGH
- Status
- MONITORING
- Category
- SUPPLY_CHAIN
- First published
- 2026-02-27
- Last reviewed
- 2026-02-27
- Attribution
- WageMole
- Attribution confidence
- HIGH
- Nation-state nexus
- North Korea
- Motivation
- FINANCIAL
- Target sectors
- technology, software_development, cryptocurrency, enterprise
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 22
Famous Chollima (DPRK-linked, Contagious Interview cluster) published 17 malicious npm packages (Feb 25-26, 2026) containing an identical obfuscated JavaScript loader that uses a novel text steganography technique to decode C2 URLs from seemingly benign Pastebin posts. The decoded URLs resolve to 32 Vercel-hosted C2 domains with platform-specific payloads (Linux/macOS/Windows). Part of an unusually rapid development pace — two novel loader techniques in one week (Pastebin steganography + Google Drive stager).
How Famous Chollima (DPRK) npm Supply Chain works
Famous Chollima (also known as the Contagious Interview cluster within the Lazarus Group ecosystem) deployed 17 malicious npm packages between 19:38 UTC on February 25 and 10:35 UTC on February 26, 2026 — a 15-hour burst across 12+ throwaway npm accounts. All packages contain an identical malicious JavaScript file at vendor/scrypt-js/version.js (SHA256: da1775d0fbe99fbc35b6f0b4a3a3cb84da3ca1b2c1bbac0842317f6f804e30a4).
The infection chain begins with an npm install script ('node ./scripts/test/install.js') that imports and executes the obfuscated payload. The payload implements a novel text steganography dead-drop resolver: it fetches seemingly benign text from three hardcoded Pastebin URLs (CJ5PrtNk as primary, 0ec7i68M and DjDCxcsT as fallbacks), then applies a custom decoder to extract hidden C2 URLs from specific character positions in the text. The Pastebin posts appear completely innocuous — normal English text with minor 'inexplicable typos' that actually encode the steganographic payload.
All three Pastebin posts decode to the same array of 32 Vercel-hosted domains following a consistent naming pattern: [word]-ext[NNN].vercel.app and [word]-app[NNN].vercel.app (e.g., ext-checkdin.vercel.app, cleverstack-ext301.vercel.app). Only the first domain (ext-checkdin.vercel.app) returns a 200 response, the remaining 31 serve as pre-positioned fallbacks that can be activated if the primary is taken down.
The C2 server delivers platform-specific payloads: Linux receives a bash script via /api/l that downloads tokenlinux.npl (renamed to .sh) to ~/.config/, macOS receives a bash script via /api/m that downloads to ~/Library/, Windows receives a cmd script via /api/w that downloads to %APPDATA%. All payloads execute silently with detached processes. The C2 also implements user-agent filtering — non-curl requests receive a fake 'Permanently suspended' response.
The packages typosquat popular npm libraries: daytonjs (dayjs), corstoken (cors), loadash-lint (lodash), expressjs-lint (express), fastify-lint (fastify), sequelization (sequelize), vitetest-lint (vitest), ether-lint (ethers), among others. The npm accounts use variations of 'christopher.smith', 'andrew.walker', and other Western-sounding names with Gmail addresses.
This campaign occurred alongside another novel technique the same week — Famous Chollima testing Google Drive as a malware stager via express-core-validator. Operator IP tracking via temporary email service OPSEC failures revealed consistent use of Astrill VPN and a Russian TransTeleCom IP (62.33.223.164, geolocated to Moscow), consistent with GitLab's observations of DPRK IT Worker operations.
MITRE ATT&CK techniques used in TL-2026-0152
defense-evasion
T1027.002 Software Packing; T1027.003 Steganography; T1036.005 Match Legitimate Resource Name or Location; T1070.004 File Deletion
execution
T1059.003 Windows Command Shell; T1059.004 Unix Shell; T1059.007 JavaScript; T1204.002 Malicious File
command-and-control
T1071.001 Web Protocols; T1102.001 Dead Drop Resolver; T1102.002 Bidirectional Communication; T1105 Ingress Tool Transfer
discovery
T1082 System Information Discovery
initial-access
T1195.001 Compromise Software Dependencies and Development Tools
privilege-escalation
resource-development
T1583.006 Web Services; T1585.001 Social Media Accounts; T1586.002 Email Accounts; T1608.001 Upload Malware
Affected products and versions in Famous Chollima (DPRK) npm Supply Chain
- npm — npm Registry
Vulnerable versions: 17 malicious packages published Feb 25-26 2026
Remediation for Famous Chollima (DPRK) npm Supply Chain
Immediate actions
- Audit npm dependencies for the 17 malicious packages listed in IOCs — remove immediately if found
- Search for vendor/scrypt-js/version.js in node_modules directories
- Block Pastebin URLs CJ5PrtNk, 0ec7i68M, DjDCxcsT at proxy/firewall
- Block ext-checkdin.vercel.app and all 32 decoded Vercel domains
- Hunt for Node.js processes making DNS requests to pastebin.com
- Search for tokenlinux.sh in ~/.config/ (Linux) and ~/Library/ (macOS), token.cmd in %APPDATA% (Windows)
Workarounds
- Use --ignore-scripts flag during npm install to prevent install script execution
- Pin exact dependency versions in package.json
- Use npm audit and socket.dev for supply chain monitoring
Longer-term hardening
- Implement npm package vetting and lock files (package-lock.json) in CI/CD pipelines
- Monitor for npm install scripts executing network requests to paste sites
- Deploy allowlisting for npm packages in enterprise environments
- Monitor Node.js processes spawning curl/wget as child processes
- Block temporary email domains at registration for developer platforms
Weaknesses (CWE) in Famous Chollima (DPRK) npm Supply Chain
CWE-506, CWE-829, CWE-494
Timeline of Famous Chollima (DPRK) npm Supply Chain
- kmsec begins tracking Famous Chollima npm publish IPs via temporary email service OPSEC failures — Astrill VPN and hide.me VPN exit IPs observed
- Famous Chollima observed publishing npm packages from Russian TransTeleCom IP 62.33.223.164 (Moscow) — used consistently through January 2026
- Three Pastebin dead-drop posts created by users davidsouza23 and Edgar04231 — contain steganographic text encoding 32 Vercel C2 URLs
- Famous Chollima publishes express-core-validator with novel Google Drive stager — first observed use of Google Drive for malware staging
- First malicious package ether-lint published at 19:38 UTC. 10 packages published within 4 hours across 7 throwaway npm accounts
- kmsec publishes analysis of Pastebin text steganography technique. Malpedia indexes the threat. Source: kmsec.uk
- Final 7 packages published between 10:05-10:35 UTC. Total: 17 packages in 15 hours. Primary Pastebin dead-drop accumulates 353 views (likely victim count)
- Threadlinqs Intelligence publishes TL-2026-0152 with full MITRE mapping, detections, and simulations
- As of 2026-05-29, the specific Feb 2026 StegaBin burst (17/26 npm packages, Pastebin dead-drop, 32 Vercel C2 nodes) is contained — packages flagged/removed within minutes and infra blocked. But Famous Chollima/Contagious Interview remains highly active: kmsec's DPRK feed logs malicious npm publishing through May 28, 2026 plus successor campaigns (PromptMink, Contagious Trader), no actor takedown.
Sources cited for Famous Chollima (DPRK) npm Supply Chain
- kmsec: Novel DPRK stager using Pastebin and text steganography
- kmsec: DPRK tests Google Drive as a malware stager
- kmsec: Tracking DPRK operator IPs over time
- kmsec: DPRK npm tracking dashboard
- Malpedia: Famous Chollima Pastebin Steganography
- GitLab: North Korean adversary operations (operator IP context)
- Open Source Malware: Contagious Interview VS Code Tasks
Threats related to Famous Chollima (DPRK) npm Supply Chain
- Contagious Interview IDE Task Hijacking — North Korean BeaverTail/PyLangGhost/GolangGhost via VS Code & Cursor Tasks, GitHub Gist Staging, Developer Targeting
- Malicious Next.js Repositories — Developer-Targeting C2 Campaign via VSCode Workspace Abuse, Job-Themed Lures, and Staged JavaScript Execution
- DPRK Contagious Interview Supply Chain RAT Campaign via npm, PyPI, and Multi-Ecosystem Package Poisoning
- PolinRider Campaign: North Korea-Linked Supply Chain Attack Expands Across npm, Packagist, Go Modules, and Chrome Web Store (DEV#POPPER / OmniStealer)
Detection coverage for TL-2026-0152
As of 2026-02-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0152 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.