Threat reportSupply ChainTL-2026-4837
DeceptiveDevelopment (North Korea-aligned) Steals Developer Credentials to Inject Malware Into GitHub Repositories and Software Packages
DeceptiveDevelopment (North Korea-aligned) Steals Developer (TL-2026-4837), also tracked as Contagious Interview (related campaign), is a high-severity supply-chain compromise, first published 2026-10-30. It is attributed to Contagious Interview - G1052 (North Korea) with medium confidence, affects Various npm packages, maps to 18 MITRE ATT&CK techniques (T1027, T1056.001, T1059.006), and is covered by 9 detection rules and 24 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 18MITRE ATT&CK
- Actors
- 1Contagious Interview - G1052
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 24Indicators of compromise
Key facts for TL-2026-4837
- Threat ID
- TL-2026-4837
- Also known as
- Contagious Interview (related campaign), PolinRider (related campaign)
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- Last reviewed
- Attribution
- Contagious Interview - G1052
- Attribution confidence
- MEDIUM
- Nation-state nexus
- North Korea
- Motivation
- FINANCIAL
- Target sectors
- technology, software development, cryptocurrency, open-source
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 24
Malware and tooling in DeceptiveDevelopment (North Korea-aligned) Steals Developer
Malware and tooling: DEV#POPPER, NullReceiver, OmniStealer, Python, ViteVenom, clientCode, socket.io-client
How DeceptiveDevelopment (North Korea-aligned) Steals Developer works
ESET reports that North Korea-aligned DeceptiveDevelopment has moved from fake job-interview lures to broader software supply-chain compromise. The group harvests developer credentials (Git credentials, SSH keys, access tokens) and uses that access to inject malicious code into public and private repositories and packages. Malware includes the OmniStealer infostealer, the DEV#POPPER RAT and the NullReceiver loader.
ESET's APT Activity Report Q2-Q3 2026 (published 2026-10-28, covering April-September 2026) states that DeceptiveDevelopment moved from fake job-interview lures to broader software supply-chain compromises, harvesting developer credentials and using that access to inject malicious code into public and private source code repositories. Per press coverage of the report (Cyber Security News, 2026-10-30), the initial compromise is a fake coding challenge or recruiter task hosted on Gitea. Malware on the victim host searches for Git credentials, SSH keys and access tokens. The operators then log in as the developer, inject malicious code into repositories and rewrite commit history to hide the changes. Affected distribution channels named in the coverage are npm, the Go module mirror, Packagist, PyPI and browser extension marketplaces. Persistence is described as hidden VS Code tasks that launch a blockchain lookup chain.
Malware named in the coverage: OmniStealer, a frequently updated multi-OS Python infostealer targeting browser logins, crypto wallets, password managers and developer secrets. DEV#POPPER is a Node.js RAT with keylogging and command execution that persists in VS Code, Cursor and Discord. NullReceiver (spelled NullReceive in the article text) is a loader that reads the command-server IP from the recipient addresses of Ethereum blockchain transactions, so C2 can be switched without shipping a package update. Infrastructure resilience comes from self-hosted Gitea instances (no central takedown point), JSONBin.io and JSONHosting for payload storage, the Pinata IPFS gateway (content-addressed), and blockchain-based C2 resolution.
Technical detail from eSentire's DEV#POPPER analysis (2026-03-05), a related campaign attributed with high confidence to North Korean state-sponsored actors: victims clone a malicious repository (named ShoeVista, posing as an eCommerce app) and running the frontend triggers a five-stage chain. Stage 1 is an obfuscated Node.js backdoor hidden with whitespace obfuscation in frontend/tailwind.config.js. Stage 2 fetches Stage 3 from C2 with an XOR-decrypted response. Stage 3 is the DEV#POPPER RAT/OmniStealer loader with anti-analysis checks. Stage 4 retrieves the RAT source from blockchain transaction data (Tron lookup, then Binance Smart Chain), and Stage 5 runs the RAT in memory. The RAT supports commands such as ss_info, ss_cb (clipboard theft), ss_upf/ss_upd (upload), ss_inz/ss_inzx (code injection into Node.js applications such as VS Code, GitHub Desktop, Discord, Cursor and Antigravity), ss_eval and ss_connect (change C2). OmniStealer targets Chromium and Firefox/Safari data, 100+ wallet extensions, desktop wallets, Git credentials and OS keystores, and exfiltrates password-protected ZIP archives over HTTP or Telegram. Anti-analysis includes crash-on-beautify, regex self-integrity checks and avoidance of cloud, CI/CD, container and sandbox environments.
A further supply-chain case reported by detections.ai: two beta releases in the @joyfill npm namespace (@joyfill/layouts and @joyfill/components) delivered DEV#POPPER, a clientCode remote-shell RAT and OmniStealer. The code executes at import time, so npm install --ignore-scripts does not stop it. Tiered C2 resolution uses Tron, Aptos and BNB Smart Chain, and persistence modifies VS Code, GitHub CLI and npm global configuration. That report links the activity to the PolinRider and Contagious Interview campaigns. Whether the Joyfill incident is part of the ESET-reported DeceptiveDevelopment activity is not stated in the sources reviewed. The ESET public summary and the news coverage list no IOCs; the network IOCs below come from the eSentire analysis of the related DEV#POPPER/OmniStealer campaign. BeaconBeagle returned no matches (HTTP 404) for any of the four C2 IPs. No CVE is assigned to this threat.
MITRE ATT&CK techniques used in TL-2026-4837
Defense Evasion
T1027 Obfuscated Files or Information; T1497 Virtualization/Sandbox Evasion; T1622 Debugger Evasion
Collection
T1056.001 Keylogging; T1560.001 Archive via Utility
Execution
T1059.006 Python; T1059.007 JavaScript; T1204.002 Malicious File
Initial Access
T1078 Valid Accounts; T1195.001 Compromise Software Dependencies and Development Tools; T1195.002 Compromise Software Supply Chain
Command and Control
Credential Access
T1552.001 Credentials In Files; T1552.004 Private Keys; T1555.003 Credentials from Web Browsers
Persistence
T1554 Compromise Host Software Binary
Resource Development
Affected products and versions in DeceptiveDevelopment (North Korea-aligned) Steals Developer
- Various — npm packages
Vulnerable versions: @joyfill/layouts (beta releases); @joyfill/components (beta releases) - Various — Go module mirror, Packagist, PyPI and browser extension marketplace packages
- Various — Developer workstations (Windows, macOS, Linux) running VS Code, Cursor, Discord, GitHub Desktop
- Various — Public and private source code repositories
Remediation for DeceptiveDevelopment (North Korea-aligned) Steals Developer
Immediate actions
- Never run recruiter-supplied or coding-challenge code on primary work machines; use disposable isolated VMs
- Rotate Git tokens, SSH keys and package-publishing credentials (npm, PyPI, Packagist, Go) on any host that ran untrusted interview code
- Audit recent commits and force-push/ref-update events on repositories for rewritten history
- Block or alert on the C2 IPs listed in the IOC set at the perimeter
- Isolate hosts that imported @joyfill/layouts or @joyfill/components beta releases and rotate all credentials on them
Workarounds
- Restrict egress from build and CI systems to approved registries and endpoints
- Alert on access to JSONBin.io, JSONHosting and IPFS gateways (e.g. Pinata) from developer and CI hosts where not business-justified
Longer-term hardening
- Enforce hardware-backed SSH keys and short-lived, scoped tokens for repository and registry access
- Require protected branches, signed commits and review for changes to package publishing paths
- Monitor developer workstations and build systems for unexpected blockchain RPC traffic (Trongrid, bsc-dataseed.binance.org, Ethereum nodes)
- Monitor for unexpected changes to VS Code tasks, Cursor, Discord, GitHub Desktop, GitHub CLI and npm global configuration
Timeline of DeceptiveDevelopment (North Korea-aligned) Steals Developer
- eSentire TRU publishes technical analysis of the DEV#POPPER RAT and OmniStealer, including the ShoeVista repository lure, blockchain-staged payloads and C2 infrastructure on ASN 149440
- Start of the April-September 2026 period covered by ESET's report, in which DeceptiveDevelopment shifted from fake job-interview lures to supply-chain compromise of repositories and packages
- detections.ai publishes analysis of compromised @joyfill/layouts and @joyfill/components npm beta releases delivering DEV#POPPER, clientCode and OmniStealer via import-time execution and Tron/Aptos/BNB Smart Chain tiered C2, linked to PolinRider and Contagious Interview
- End of the April-September 2026 reporting period for ESET's APT Activity Report Q2-Q3 2026
- ESET publishes the APT Activity Report Q2 2026 - Q3 2026 documenting DeceptiveDevelopment credential theft and repository/package injection
- Cyber Security News reports the ESET findings, naming OmniStealer, DEV#POPPER and NullReceiver and the npm, Go module mirror, Packagist, PyPI and browser extension marketplace distribution channels
Sources cited for DeceptiveDevelopment (North Korea-aligned) Steals Developer
- North Korean Hackers Steal Developer Credentials to Inject Malware Into GitHub and Software Packages
- ESET APT Activity Report Q2 2026 - Q3 2026
- eSentire TRU: North Korean APT Malware Analysis - DEV#POPPER RAT and OmniStealer
- Compromised Joyfill npm Packages Deliver DEV#POPPER RAT
- Bogus npm Packages Used to Trick Software Developers (The Hacker News)
- North Korean Cyberspies Trick Developers Into Installing Malware With Fake Job Interviews (Beyond Identity)
- Sophisticated NPM Attack: Cross-Platform Infostealer Targets Developer Systems (Technijian)
Detection coverage for TL-2026-4837
As of 2026-10-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4837 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-4837
4 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.