Famous Chollima (DPRK) Compromises Packagist Package roberts/leads dev Branch — tailwind.js Node.js Loader Uses TRON/Aptos/BNB Blockchain Dead-Drop C2 (EtherHiding-style) — Threadlinqs Intelligence
As of 2026-06-01, Famous Chollima (DPRK) Compromises Packagist Package roberts/leads dev Branch — tailwind.js Node.js Loader Uses TRON/Aptos/BNB Blockchain Dead-Drop C2 (EtherHiding-style) is a high-severity supply chain threat attributed to WageMole (North Korea), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 22 indicators of compromise.
Threat ID: TL-2026-0638 · Severity: HIGH · Status: ACTIVE · Category: SUPPLY_CHAIN
Attribution: WageMole · North Korea · FINANCIAL
North Korean state-sponsored actor Famous Chollima compromised the development branch (dev-drewroberts/feature/test-case) of the legitimate PHP Packagist package roberts/leads, hiding an obfuscated
On 2026-06-01 Socket.dev disclosed a targeted software supply-chain compromise attributed to the North Korean state-sponsored intrusion set Famous Chollima (the developer-lure cluster also tracked as Contagious Interview, Wagemole, Nickel Tapestry, Purple Bravo, Storm-1877, and UNC5342/UNC5267, operating within the broader Lazarus collective). Rather than publishing a typosquatted package, the actor compromised a development branch of a legitimate, trusted PHP package — roberts/leads — by pushing a malicious commit (6c5c3c7655ce76399af11126b7e9a9058eb2e45d) to the branch drewroberts/feature/test-case, surfaced on Packagist as the installable version dev-drewroberts/feature/test-case. This keeps the published stable releases clean while weaponizing the dev channel that targeted developers are socially engineered into installing.
The malicious logic is hidden in a file named tailwind.js, masquerading as a Tailwind CSS configuration. The attacker placed the obfuscated JavaScript far to the right of the line, behind a large block of blank space so it remains invisible during casual code review or diff inspection. The file is benign to a CSS toolchain but, when evaluated by Node.js during a build step, transforms into a full malware loader. The loader carries hardcoded XOR keys — first stage 2[gWfGj;<:-93Z^C and second stage m6:tTh^D)cBz?NM] — and an embedded campaign marker, global['!']='9-0264-2', a known identifier tied to prior Famous Chollima operations and the basis for linking this activity to the DEV#POPPER RAT, OmniStealer, and BeaverTail malware families.
The defining tradecraft is the command-and-control mechanism: instead of contacting an attacker-owned domain or IP, the loader reads attacker-staged data directly from public blockchain ledgers — TRON, Aptos, and BNB Smart Chain — using each chain's public RPC/read APIs. This is an EtherHiding-style dead-drop resolver: the encrypted second-stage payload is stored inside blockchain transaction records, the loader retrieves the blob, XOR-decrypts it with the hardcoded keys, and executes the result in-process via eval(). On TRON the first-stage dead-drop is wallet TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP and the second-stage is TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG; on Aptos the first-stage fallback account is 0xbe037400670fbf1c32364f762975908dc43eeb38759263e7dfcdabc76380811e and the second-stage fallback is 0x3f0e5781d0855fb460661ac63257376db1941b2bb522499e4757ecb3ebd5dce3. Because the payloads live on decentralized ledgers, the infrastructure cannot be domain-blocked, sinkholed, or taken down, and reads blend in as ordinary Web3/RPC traffic.
Post-execution, the loader spawns a hidden process via child_process.spawn with windowsHide set to true to avoid a visible console window, then the staged payload enumerates and exfiltrates developer secrets: environment variables holding cloud credentials and CI/CD tokens, .env files, SSH private keys, and other stored tokens. This is consistent with Famous Chollima's financially motivated objective — credential and cryptocurrency theft to generate sanctions-evading revenue for the DPRK — and with the group's evolution from inserting fake employees into companies to luring individual engineers with fake job offers, technical assessments, and onboarding tasks. The campaign was deliberately scoped to target one developer at a time rather than cause noisy, widespread infection.
The combination of (1) compromise of a trusted package's dev branch, (2) loader concealment behind whitespace in a fake build-tool config, (3) blockchain dead-drop C2 across three chains with XOR-encrypted multi-stage payloads, and (4) eval()-based in-memory execution makes this both highly evasive and operationally resilient. There is no CVE; the vulnerability is trust in unpinned dev-branch dependencies and execution of untrusted build configuration. Following Socket's disclosure the malicious dev version was removed from Packagist, but the staged blockchain payload
Weaknesses (CWE)
CWE-506, CWE-829, CWE-94, CWE-1357
Target sectors: technology, software-development, cryptocurrency, blockchain, financial
Target regions: North America, Europe, Asia, Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 22 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, HIGH, threat intelligence, cybersecurity, T1586, T1585, T1608, T1195, T1566, T1059, T1204, T1027, T1140, T1564