Lazarus Group npm Brandjacking Campaign — buffer-utilities Multi-Stage Staging Framework (sonatype-2026-003558)
Lazarus Group npm Brandjacking Campaign (TL-2026-0726), also tracked as buffer-utilities campaign, is a high-severity supply-chain compromise, first published 2026-06-09. It is attributed to Lazarus Group (North Korea) with medium confidence, affects npm (OpenJS / npm Inc.) npm Registry packages, maps to 22 MITRE ATT&CK techniques (T1005, T1027, T1033), and is covered by 9 detection rules and 24 indicators of compromise.
Key facts for TL-2026-0726
- Threat ID
- TL-2026-0726
- Also known as
- buffer-utilities campaign, Lazarus npm brandjacking, sonatype-2026-003558
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-06-09
- Last reviewed
- 2026-06-09
- Attribution
- Lazarus Group
- Attribution confidence
- MEDIUM
- Nation-state nexus
- North Korea
- Motivation
- FINANCIAL
- Target sectors
- technology, software-development, cryptocurrency, blockchain, financial, open-source
- Target regions
- North America, Europe, Asia, Global
- Detection rules
- 9
- Indicators of compromise
- 24
Malware and tooling in Lazarus Group npm Brandjacking Campaign
Malware and tooling: Custom Node.js staging framework / backdoor
North Korea's Lazarus Group is distributing dozens of malicious npm packages via brandjacking — impersonating Buffer, Chai, React, Express, JWT, and Webpack libraries. The flagship package buffer-utilities acts as a persistent multi-stage staging framework: it Base64-decodes URLs pointing to www.jsonkeeper.com, retrieves remote JavaScript, and executes it with eval(), then deploys a Node.js backdoor that beacons to C2 at 45.59.163.198:1244.
How Lazarus Group npm Brandjacking Campaign works
Sonatype Security Research (tracking ID sonatype-2026-003558) disclosed on 2026-06-03 an active Lazarus Group supply-chain campaign abusing the npm registry. Rather than simple typosquatting, the operators rely on brandjacking — suffix addition, name embedding, and version mimicry — to publish packages that appear ecosystem-adjacent to widely trusted libraries such as Buffer, Chai, React, Express, JWT, and Webpack. Some packages accrued up to 500 weekly downloads before takedown, indicating real developer impact.
The analyzed flagship package, buffer-utilities@1.0.0, impersonates the legitimate buffer package and operates as a malicious dropper / staging framework. On install/import, Stage 1 decodes Base64-encoded URLs that resolve to www.jsonkeeper.com — an attacker-controlled payload host that Sonatype notes has been repeatedly used by Lazarus to store payloads — fetches remote content, and immediately executes it via eval(), giving the operators arbitrary remote code execution inside the developer's environment with no further interaction.
Stage 2 installs a Node.js backdoor and downloader. It performs host reconnaissance — collecting hostname, username, operating system, home directory, and process arguments — then contacts command-and-control infrastructure at 45.59.163.198 on TCP port 1244 to register the victim and receive further instructions. The backdoor creates a hidden .vscode directory in the user's home folder, runs 'npm install --silent' to silently fetch dependencies, downloads additional files, and launches a third-stage JavaScript payload (f.js) as a detached background process.
Stage 3 (f.js plus a fetched package.json) implements an update mechanism that periodically reconnects to C2 for version checks and file replacement, giving the operators durable, swappable post-exploitation capability — a true staging framework rather than a single-shot stealer. The campaign aligns with the broader Lazarus developer-targeting pattern (Contagious Interview / fake-recruiter operations and the earlier 'graphalgo' npm/PyPI cluster), which has previously deployed credential and cryptocurrency-wallet theft modules (e.g., targeting Solana keypair files and browser credential stores). Defenders should hunt for connections to www.jsonkeeper.com, C2 traffic to 45.59.163.198:1244, unexpected .vscode directories in user home folders, and anomalous detached Node.js processes on developer and CI/build systems.
MITRE ATT&CK techniques used in TL-2026-0726
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1564 Hide Artifacts
Discovery
T1033 System Owner/User Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1132 Data Encoding; T1571 Non-Standard Port
Initial Access
Credential Access
T1552 Unsecured Credentials; T1555 Credentials from Password Stores
Persistence
T1554 Compromise Host Software Binary
Resource Development
T1585 Establish Accounts; T1587 Develop Capabilities; T1608 Stage Capabilities
Affected products and versions in Lazarus Group npm Brandjacking Campaign
- npm (OpenJS / npm Inc.) — npm Registry packages
Vulnerable versions: buffer-utilities@1.0.0; node-background-invoker-v2@1.0.1-1.0.6 - Developer / CI environments — Node.js developer workstations and build pipelines
Vulnerable versions: any consuming the malicious packages
Remediation for Lazarus Group npm Brandjacking Campaign
Immediate actions
- Block outbound connections to www.jsonkeeper.com and to 45.59.163.198:1244 at the perimeter and on developer/CI egress
- Audit npm dependency trees for buffer-utilities and the other listed brandjacked package names; remove and rebuild from clean lockfiles
- Hunt for and remove unexpected hidden .vscode directories in user home folders and any f.js dropped payloads
- Rotate developer credentials, npm tokens, cloud keys, and any cryptocurrency wallet keys exposed on affected hosts
Workarounds
- Use --ignore-scripts on npm install where feasible and review postinstall/import-time code paths
- Disable arbitrary outbound network access during dependency installation in CI
Longer-term hardening
- Deploy EDR with behavioral detection for Node.js processes spawning detached child processes and performing network beaconing
- Enforce dependency pinning, lockfile integrity, and an internal package proxy/allowlist (e.g., private registry, Socket/Sonatype Firewall)
- Adopt scoped, least-privilege npm publish/install tokens and 2FA on all internal package accounts
- Isolate build/CI environments and developer install steps in sandboxes with no standing access to production secrets or wallets
Weaknesses (CWE) in Lazarus Group npm Brandjacking Campaign
CWE-506, CWE-829, CWE-94, CWE-95
Timeline of Lazarus Group npm Brandjacking Campaign
- Related Lazarus developer-targeting npm/PyPI cluster ('graphalgo') begins, seeding malicious packages (per The Hacker News / SecurityScorecard reporting).
- Lazarus campaign planting malicious npm and PyPI packages (graphalgo cluster, Veltrix Capital fake-recruiter lure) publicly reported by The Hacker News.
- SecurityScorecard publishes analysis of Lazarus Group targeting developers through npm packages and broader supply-chain attacks, reinforcing DPRK attribution and developer-focused TTPs.
- Veracode publishes analysis of resurgent North Korean npm malware campaign (23 packages) overlapping in TTPs (eval-based remote payloads, Solana wallet and browser credential theft, ip-check-api.vercel.app victim tracking).
- C2 infrastructure identified: payload host www.jsonkeeper.com (Base64-encoded URLs) and command-and-control endpoint 45.59.163.198:1244.
- Sonatype Security Research publicly discloses the brandjacking campaign and analyzed buffer-utilities@1.0.0 staging framework; assigns tracking ID sonatype-2026-003558.
- Independent reporting (Hackread, Security Boulevard) confirms campaign details: up to 500 weekly downloads on some packages, hidden .vscode persistence, and f.js third-stage payload.
- Threat documented and enriched in Threadlinqs Intelligence Platform with full MITRE ATT&CK mapping and IOC set.
Sources cited for Lazarus Group npm Brandjacking Campaign
- Lazarus Group's Latest: Brandjacking Campaign on npm
- Lazarus Group Uses npm Brandjacking Campaign to Target Developers
- Lazarus Group's Latest: Brandjacking Campaign on npm (Security Boulevard)
- Resurgent North Korean Malware Campaign in npm
- Lazarus Campaign Plants Malicious Packages in npm and PyPI Ecosystems
- Lazarus Group Targets Developers Through NPM Packages and Supply Chain Attacks
- MITRE ATT&CK Group G0032 — Lazarus Group
Threats related to Lazarus Group npm Brandjacking Campaign
Detection coverage for TL-2026-0726
As of 2026-06-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0726 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-0726
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.