Lazarus Group npm Brandjacking Campaign — buffer-utilities Multi-Stage Staging Framework (sonatype-2026-003558) — Threadlinqs Intelligence
As of 2026-06-09, Lazarus Group npm Brandjacking Campaign — buffer-utilities Multi-Stage Staging Framework (sonatype-2026-003558) is a high-severity supply chain threat attributed to Lazarus Group (North Korea), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 24 indicators of compromise.
Threat ID: TL-2026-0726 · Severity: HIGH · Status: ACTIVE · Category: SUPPLY_CHAIN
Attribution: Lazarus Group · North Korea · FINANCIAL
North Korea's Lazarus Group is distributing dozens of malicious npm packages via brandjacking — impersonating Buffer, Chai, React, Express, JWT, and Webpack libraries. The flagship package
Sonatype Security Research (tracking ID sonatype-2026-003558) disclosed on 2026-06-03 an active Lazarus Group supply-chain campaign abusing the npm registry. Rather than simple typosquatting, the operators rely on brandjacking — suffix addition, name embedding, and version mimicry — to publish packages that appear ecosystem-adjacent to widely trusted libraries such as Buffer, Chai, React, Express, JWT, and Webpack. Some packages accrued up to 500 weekly downloads before takedown, indicating real developer impact.
The analyzed flagship package, buffer-utilities@1.0.0, impersonates the legitimate buffer package and operates as a malicious dropper / staging framework. On install/import, Stage 1 decodes Base64-encoded URLs that resolve to www.jsonkeeper.com — an attacker-controlled payload host that Sonatype notes has been repeatedly used by Lazarus to store payloads — fetches remote content, and immediately executes it via eval(), giving the operators arbitrary remote code execution inside the developer's environment with no further interaction.
Stage 2 installs a Node.js backdoor and downloader. It performs host reconnaissance — collecting hostname, username, operating system, home directory, and process arguments — then contacts command-and-control infrastructure at 45.59.163.198 on TCP port 1244 to register the victim and receive further instructions. The backdoor creates a hidden .vscode directory in the user's home folder, runs 'npm install --silent' to silently fetch dependencies, downloads additional files, and launches a third-stage JavaScript payload (f.js) as a detached background process.
Stage 3 (f.js plus a fetched package.json) implements an update mechanism that periodically reconnects to C2 for version checks and file replacement, giving the operators durable, swappable post-exploitation capability — a true staging framework rather than a single-shot stealer. The campaign aligns with the broader Lazarus developer-targeting pattern (Contagious Interview / fake-recruiter operations and the earlier 'graphalgo' npm/PyPI cluster), which has previously deployed credential and cryptocurrency-wallet theft modules (e.g., targeting Solana keypair files and browser credential stores). Defenders should hunt for connections to www.jsonkeeper.com, C2 traffic to 45.59.163.198:1244, unexpected .vscode directories in user home folders, and anomalous detached Node.js processes on developer and CI/build systems.
Weaknesses (CWE)
CWE-506, CWE-829, CWE-94, CWE-95
Target sectors: technology, software-development, cryptocurrency, blockchain, financial, open-source
Target regions: North America, Europe, Asia, Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 24 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
SUPPLY_CHAIN, HIGH, threat intelligence, cybersecurity, T1587, T1585, T1608, T1195, T1204, T1059, T1554, T1036, T1564, T1027