Famous Chollima (DPRK) Compromises Packagist Package roberts/leads dev Branch — tailwind.js Node.js Loader Uses TRON/Aptos/BNB Blockchain Dead-Drop C2 (EtherHiding-style)
Famous Chollima (DPRK) Compromises Packagist Package (TL-2026-0638), also tracked as roberts/leads dev-branch supply-chain compromise, is a high-severity supply-chain compromise, first published 2026-06-01. It is attributed to WageMole (North Korea) with high confidence, affects roberts (Packagist maintainer) roberts/leads (PHP Composer/Packagist, maps to 19 MITRE ATT&CK techniques (T1005, T1027, T1041), and is covered by 9 detection rules and 22 indicators of compromise.
Key facts for TL-2026-0638
- Threat ID
- TL-2026-0638
- Also known as
- roberts/leads dev-branch supply-chain compromise, tailwind.js blockchain dead-drop loader, campaign 9-0264-2
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-06-01
- Last reviewed
- 2026-06-01
- Attribution
- WageMole
- Attribution confidence
- HIGH
- Nation-state nexus
- North Korea
- Motivation
- FINANCIAL
- Target sectors
- technology, software-development, cryptocurrency, blockchain, financial
- Target regions
- North America, Europe, Asia, Global
- Detection rules
- 9
- Indicators of compromise
- 22
Malware and tooling in Famous Chollima (DPRK) Compromises Packagist Package
Malware and tooling: BeaverTail - S1246, DEV#POPPER, OmniStealer, TRON / Aptos / BNB Smart Chain dead-drop (EtherHiding-style)
North Korean state-sponsored actor Famous Chollima compromised the development branch (dev-drewroberts/feature/test-case) of the legitimate PHP Packagist package roberts/leads, hiding an obfuscated JavaScript loader inside a fake tailwind.js Tailwind CSS config concealed behind off-screen whitespace. Under Node.js the loader fetches XOR-encrypted second-stage payloads from public blockchain dead-drops on TRON, Aptos, and BNB Smart Chain (no traditional C2 domain), decrypts them with hardcoded XOR keys, runs them via eval(), and spawns a hidden child process (windowsHide:true) that harvests .env files, SSH keys, cloud/CI secrets, and tokens. Developers are lured into installing the poisoned dev version through fake interview and onboarding tasks. Socket.dev disclosed it and the malicious dev version has been removed from Packagist.
How Famous Chollima (DPRK) Compromises Packagist Package works
On 2026-06-01 Socket.dev disclosed a targeted software supply-chain compromise attributed to the North Korean state-sponsored intrusion set Famous Chollima (the developer-lure cluster also tracked as Contagious Interview, Wagemole, Nickel Tapestry, Purple Bravo, Storm-1877, and UNC5342/UNC5267, operating within the broader Lazarus collective). Rather than publishing a typosquatted package, the actor compromised a development branch of a legitimate, trusted PHP package — roberts/leads — by pushing a malicious commit (6c5c3c7655ce76399af11126b7e9a9058eb2e45d) to the branch drewroberts/feature/test-case, surfaced on Packagist as the installable version dev-drewroberts/feature/test-case. This keeps the published stable releases clean while weaponizing the dev channel that targeted developers are socially engineered into installing.
The malicious logic is hidden in a file named tailwind.js, masquerading as a Tailwind CSS configuration. The attacker placed the obfuscated JavaScript far to the right of the line, behind a large block of blank space so it remains invisible during casual code review or diff inspection. The file is benign to a CSS toolchain but, when evaluated by Node.js during a build step, transforms into a full malware loader. The loader carries hardcoded XOR keys — first stage 2[gWfGj;<:-93Z^C and second stage m6:tTh^D)cBz?NM] — and an embedded campaign marker, global['!']='9-0264-2', a known identifier tied to prior Famous Chollima operations and the basis for linking this activity to the DEV#POPPER RAT, OmniStealer, and BeaverTail malware families.
The defining tradecraft is the command-and-control mechanism: instead of contacting an attacker-owned domain or IP, the loader reads attacker-staged data directly from public blockchain ledgers — TRON, Aptos, and BNB Smart Chain — using each chain's public RPC/read APIs. This is an EtherHiding-style dead-drop resolver: the encrypted second-stage payload is stored inside blockchain transaction records, the loader retrieves the blob, XOR-decrypts it with the hardcoded keys, and executes the result in-process via eval(). On TRON the first-stage dead-drop is wallet TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP and the second-stage is TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG; on Aptos the first-stage fallback account is 0xbe037400670fbf1c32364f762975908dc43eeb38759263e7dfcdabc76380811e and the second-stage fallback is 0x3f0e5781d0855fb460661ac63257376db1941b2bb522499e4757ecb3ebd5dce3. Because the payloads live on decentralized ledgers, the infrastructure cannot be domain-blocked, sinkholed, or taken down, and reads blend in as ordinary Web3/RPC traffic.
Post-execution, the loader spawns a hidden process via child_process.spawn with windowsHide set to true to avoid a visible console window, then the staged payload enumerates and exfiltrates developer secrets: environment variables holding cloud credentials and CI/CD tokens, .env files, SSH private keys, and other stored tokens. This is consistent with Famous Chollima's financially motivated objective — credential and cryptocurrency theft to generate sanctions-evading revenue for the DPRK — and with the group's evolution from inserting fake employees into companies to luring individual engineers with fake job offers, technical assessments, and onboarding tasks. The campaign was deliberately scoped to target one developer at a time rather than cause noisy, widespread infection.
The combination of (1) compromise of a trusted package's dev branch, (2) loader concealment behind whitespace in a fake build-tool config, (3) blockchain dead-drop C2 across three chains with XOR-encrypted multi-stage payloads, and (4) eval()-based in-memory execution makes this both highly evasive and operationally resilient. There is no CVE; the vulnerability is trust in unpinned dev-branch dependencies and execution of untrusted build configuration. Following Socket's disclosure the malicious dev version was removed from Packagist, but the staged blockchain payloads and the actor's broader infrastructure remain available, and the TTP pattern is expected to recur against other ecosystems.
MITRE ATT&CK techniques used in TL-2026-0638
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1140 Deobfuscate/Decode Files or Information; T1564 Hide Artifacts; T1620 Reflective Code Loading
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Discovery
T1083 File and Directory Discovery
Command and Control
T1102 Web Service; T1105 Ingress Tool Transfer; T1573 Encrypted Channel
Initial Access
T1195 Supply Chain Compromise; T1566 Phishing
Credential Access
Resource Development
T1585 Establish Accounts; T1586 Compromise Accounts; T1608 Stage Capabilities
Affected products and versions in Famous Chollima (DPRK) Compromises Packagist Package
- roberts (Packagist maintainer) — roberts/leads (PHP Composer/Packagist package)
Vulnerable versions: dev-drewroberts/feature/test-case (branch drewroberts/feature/test-case, commit 6c5c3c7655ce76399af11126b7e9a9058eb2e45d)
Fixed in: Malicious dev version removed from Packagist following Socket.dev disclosure; use pinned stable tagged releases
Remediation for Famous Chollima (DPRK) Compromises Packagist Package
Immediate actions
- Audit dependency manifests for roberts/leads pinned to dev-drewroberts/feature/test-case and remove it immediately
- Manually inspect build/config files for off-screen whitespace-concealed code: tailwind.js, webpack.mix.js, vite.config.*, postcss.config.*, .github/workflows
- Rotate any cloud credentials, CI/CD tokens, SSH keys, and .env secrets exposed to developer or CI build environments that may have run the loader
- Hunt for Node.js processes making outbound connections to TRON/Aptos/BNB Smart Chain RPC endpoints during build steps
Workarounds
- Block or alert on developer/CI hosts making Web3 RPC calls to public blockchain nodes during builds
- Avoid exposing long-lived cloud credentials to branch-level or untrusted builds
Longer-term hardening
- Pin dependencies to stable, known-good tagged releases; prohibit installing dev-branch versions
- Run package installs and builds in isolated, credential-free sandboxes with egress filtering
- Deploy EDR with behavioral detection for eval() of dynamically fetched code and child_process.spawn with windowsHide
- Treat unfamiliar build instructions delivered during interviews or onboarding as untrusted code execution events
Weaknesses (CWE) in Famous Chollima (DPRK) Compromises Packagist Package
CWE-506, CWE-829, CWE-94, CWE-1357
Timeline of Famous Chollima (DPRK) Compromises Packagist Package
- Famous Chollima (Contagious Interview / Wagemole, a Lazarus-aligned DPRK cluster) active since at least 2018, targeting developers via fake job offers and technical assessments.
- DPRK-nexus actors assessed to have stolen roughly USD 2.2B in cryptocurrency in H1 2025, underscoring the financial motivation behind developer-targeting credential and wallet theft.
- Famous Chollima/UNC5342 observed using EtherHiding — staging malware payloads inside public blockchain smart contracts (Ethereum/BNB) for resilient, un-takedownable C2 — the precedent for this campaign's TRON/Aptos/BNB dead-drops.
- Cyber Security News published a public report on the campaign targeting PHP developers.
- Malicious dev version removed from Packagist following Socket.dev disclosure; staged blockchain payloads and broader actor infrastructure remain.
- Embedded campaign marker global['!']='9-0264-2' linked the activity to prior Famous Chollima operations and the DEV#POPPER RAT, OmniStealer, and BeaverTail malware families.
- Loader analysis revealed blockchain dead-drop C2 across TRON, Aptos, and BNB Smart Chain with XOR-encrypted multi-stage payloads, eval() execution, and child_process.spawn windowsHide:true.
- Socket.dev disclosed the compromise of the roberts/leads dev branch (dev-drewroberts/feature/test-case) hiding a malicious tailwind.js Node.js loader.
Sources cited for Famous Chollima (DPRK) Compromises Packagist Package
- Famous Chollima Hackers Target PHP Developers Using Compromised Packagist Package
- Affected Packagist package — roberts/leads
- Affected repository — github.com/roberts/leads
- Famous Chollima Adversary Profile — CrowdStrike
- Socket.dev Threat Research — DPRK developer-targeting supply-chain campaigns
- North Korea Weaponizes Blockchain (EtherHiding) for Stealth Hacks, Poses as Job Recruiters
Threats related to Famous Chollima (DPRK) Compromises Packagist Package
- Joyfill npm Supply-Chain Compromise: @joyfill/components and @joyfill/layouts Ship Obfuscated Worm-Like RAT and Credential Stealer
- Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan
- PolinRider Campaign: North Korea-Linked Supply Chain Attack Expands Across npm, Packagist, Go Modules, and Chrome Web Store (DEV#POPPER / OmniStealer)
- PolinRider DPRK Supply-Chain Campaign: Confirmed GitHub Footprint Grows 6.5x Since March (JADESNOW/Beavertail/InvisibleFerret Loaders, DEV#POPPER & OmniStealer Payloads)
- JadeSnow: Hijacked npm/Go Supply Chain Attack with VSCode Exploitation and Blockchain Dead Drops
Detection coverage for TL-2026-0638
As of 2026-06-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0638 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.