DPRK npm Supply Chain Attack — terminal-logger-utils Abuses Hugging Face (Lordplay/system-releases) to Deliver Node.js SEA Keylogger/Infostealer/RAT — Threadlinqs Intelligence
As of 2026-05-30, DPRK npm Supply Chain Attack — terminal-logger-utils Abuses Hugging Face (Lordplay/system-releases) to Deliver Node.js SEA Keylogger/Infostealer/RAT is a high-severity supply chain threat attributed to Contagious Interview (North Korea (DPRK)), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 26 indicators of compromise.
Threat ID: TL-2026-0559 · Severity: HIGH · Status: ACTIVE · Category: SUPPLY_CHAIN
Attribution: Contagious Interview · North Korea (DPRK) · FINANCIAL
North Korea-linked npm uploader jpeek895 (and three colluding accounts) published terminal-logger-utils plus three dependents (pretty-logger-utils, ts-logger-pack, pinno-loggers) whose postinstall
On 2026-05-22, OX Security disclosed an active North Korea-aligned npm supply chain attack centered on the package terminal-logger-utils, uploaded by npm account jpeek895 — an account previously flagged by independent researcher kmsec.uk as part of the DPRK npm-package cluster. Three dependent packages — pretty-logger-utils, ts-logger-pack, pinno-loggers — were published by collaborating accounts jpeek886, pvnd3540749, and yggedd817513 to inflate apparent legitimacy and broaden the install footprint.
Infection Chain. When a developer runs `npm install terminal-logger-utils` (directly or transitively via one of the dependents), npm's `postinstall` lifecycle hook executes the bundled dropper `utils.cjs`. utils.cjs is a heavily obfuscated CommonJS module that performs OS dispatch (Windows / macOS / Linux), then issues an HTTPS request to the Hugging Face Hub repository `Lordplay/system-releases` (a legitimate-looking AI model hosting endpoint) to download an OS-specific Node.js Single Executable Application (SEA) binary. The SEA payload bundles a Node runtime with the malicious JavaScript, eliminating any requirement for a developer-side Node installation and reducing AV/EDR detection of the script body.
Windows Persistence. On Windows hosts the second-stage installs itself to `%LOCALAPPDATA%\MicrosoftSystem64\` — a path chosen to masquerade as a legitimate Microsoft system component. Three persistence mechanisms are established in parallel: (1) a hidden VBScript launcher dropped into the install directory that re-launches the SEA binary on user logon, (2) a Windows Scheduled Task registered under Task Scheduler that re-executes the binary at logon and on a recurring interval, and (3) an `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` registry key as a fallback autostart vector. The triple-redundant persistence is characteristic of DPRK developer-targeting clusters tracked under names such as Contagious Interview / DEV#POPPER / Famous Chollima.
Implant Capabilities. The SEA second-stage is a fused keylogger + infostealer + RAT. Keystroke capture occurs continuously and is exfiltrated over plain HTTP POST to the path `/api/validate/keyboard-events` on attacker infrastructure. Stealer modules target high-value developer artifacts: Telegram `tdata` session folders (allowing full account hijack without 2FA prompt), `~/.ssh/` keys, cryptocurrency wallet files for major hot-wallet clients (MetaMask, Phantom, Exodus, Electrum, etc.), browser-saved passwords / cookies / autofill (Chrome, Edge, Brave, Firefox profile directories), cloud configuration files (`.aws/credentials`, `gcloud` config, `kube/config`), and shell environment variables that frequently contain API tokens and database URIs. The RAT module opens a WebSocket back to `195.201.194.107` (a Hetzner-range IP) supporting interactive commands: arbitrary shell command execution, file read/write, screenshot capture, simulated input injection, and self-update via fetching new SEA blobs from the Hugging Face repository.
Hugging Face Abuse. The novel element is the abuse of Hugging Face as a malware delivery and update CDN. Hugging Face is allowlisted in many enterprise egress policies because of legitimate ML/AI workloads, and its content-addressable storage backed by Git-LFS provides versioned, high-throughput, TLS-protected delivery. The attackers benefit from: (a) trust inheritance from the platform brand, (b) bypassing URL-reputation-only blocking, (c) free hosting and bandwidth, (d) the ability to push updates by simply git-pushing new SEA blobs to `Lordplay/system-releases`, and (e) plausible deniability — the repo can be styled to look like a legitimate model release. The same pattern was previously observed with the abuse of GitHub Releases, Cloudflare Pages, and Bitbucket; Hugging Face is the next logical evolution.
Attribution. Direct attribution rests on continuity between jpeek895 and prior DPRK npm clusters catalogued by kmsec.uk. The package-naming conventio
Weaknesses (CWE)
CWE-506, CWE-829, CWE-494, CWE-1357
Target sectors: technology, software-development, cryptocurrency, financial, fintech, web3, ai-ml, devops, cloud, open-source
Target regions: Global, North America, Europe, Asia-Pacific
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 26 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, HIGH, threat intelligence, cybersecurity, T1583, T1587, T1585, T1588, T1195, T1059, T1059, T1204, T1547, T1053