# Lazarus Group npm Brandjacking Campaign — buffer-utilities Multi-Stage Staging Framework (sonatype-2026-003558)

> North Korea's Lazarus Group is distributing dozens of malicious npm packages via brandjacking — impersonating Buffer, Chai, React, Express, JWT, and Webpack libraries. The flagship package buffer-utilities acts as a persistent multi-stage staging framework: it Base64-decodes URLs pointing to www.jsonkeeper.com, retrieves remote JavaScript, and executes it with eval(), then deploys a Node.js backdoor that beacons to C2 at 45.59.163.198:1244.

- **Published:** 2026-06-09T00:00:00Z
- **Last reviewed:** 2026-06-09T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0726
- **ID:** TL-2026-0726
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** Lazarus Group (North Korea)
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Sonatype Security Research (tracking ID sonatype-2026-003558) disclosed on 2026-06-03 an active Lazarus Group supply-chain campaign abusing the npm registry. Rather than simple typosquatting, the operators rely on brandjacking — suffix addition, name embedding, and version mimicry — to publish packages that appear ecosystem-adjacent to widely trusted libraries such as Buffer, Chai, React, Express, JWT, and Webpack. Some packages accrued up to 500 weekly downloads before takedown, indicating real developer impact.

The analyzed flagship package, buffer-utilities@1.0.0, impersonates the legitimate buffer package and operates as a malicious dropper / staging framework. On install/import, Stage 1 decodes Base64-encoded URLs that resolve to www.jsonkeeper.com — an attacker-controlled payload host that Sonatype notes has been repeatedly used by Lazarus to store payloads — fetches remote content, and immediately executes it via eval(), giving the operators arbitrary remote code execution inside the developer's environment with no further interaction.

Stage 2 installs a Node.js backdoor and downloader. It performs host reconnaissance — collecting hostname, username, operating system, home directory, and process arguments — then contacts command-and-control infrastructure at 45.59.163.198 on TCP port 1244 to register the victim and receive further instructions. The backdoor creates a hidden .vscode directory in the user's home folder, runs 'npm install --silent' to silently fetch dependencies, downloads additional files, and launches a third-stage JavaScript payload (f.js) as a detached background process.

Stage 3 (f.js plus a fetched package.json) implements an update mechanism that periodically reconnects to C2 for version checks and file replacement, giving the operators durable, swappable post-exploitation capability — a true staging framework rather than a single-shot stealer. The campaign aligns with the broader Lazarus developer-targeting pattern (Contagious Interview / fake-recruiter operations and the earlier 'graphalgo' npm/PyPI cluster), which has previously deployed credential and cryptocurrency-wallet theft modules (e.g., targeting Solana keypair files and browser credential stores). Defenders should hunt for connections to www.jsonkeeper.com, C2 traffic to 45.59.163.198:1244, unexpected .vscode directories in user home folders, and anomalous detached Node.js processes on developer and CI/build systems.

## MITRE ATT&CK

- T1587 Develop Capabilities
- T1585 Establish Accounts
- T1608 Stage Capabilities
- T1195 Supply Chain Compromise
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1554 Compromise Host Software Binary
- T1036 Masquerading
- T1564 Hide Artifacts
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1083 File and Directory Discovery
- T1005 Data from Local System
- T1555 Credentials from Password Stores
- T1552 Unsecured Credentials
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1571 Non-Standard Port
- T1132 Data Encoding
- T1041 Exfiltration Over C2 Channel

## Sources

- [Lazarus Group's Latest: Brandjacking Campaign on npm](https://www.sonatype.com/blog/lazarus-groups-latest-brandjacking-campaign-on-npm)
- [Lazarus Group Uses npm Brandjacking Campaign to Target Developers](https://hackread.com/lazarus-group-npm-brandjacking-target-developers/)
- [Lazarus Group's Latest: Brandjacking Campaign on npm (Security Boulevard)](https://securityboulevard.com/2026/06/lazarus-groups-latest-brandjacking-campaign-on-npm/)
- [Resurgent North Korean Malware Campaign in npm](https://www.veracode.com/blog/resurgent-north-korean-malware-campaign-in-npm/)
- [Lazarus Campaign Plants Malicious Packages in npm and PyPI Ecosystems](https://thehackernews.com/2026/02/lazarus-campaign-plants-malicious.html)
- [Lazarus Group Targets Developers Through NPM Packages and Supply Chain Attacks](https://securityscorecard.com/blog/lazarus-group-targets-developers-through-npm-packages-and-supply-chain-attacks/)
- [MITRE ATT&CK Group G0032 — Lazarus Group](https://attack.mitre.org/groups/G0032/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0726