Security researchers report that North Korea–aligned threat actors behind the Contagious Interview campaign have published 197 additional malicious npm packages, bringing the total into one of the largest ongoing package ecosystem abuse campaigns to date. The new packages—downloaded more than 31,000 times—deliver an evolved variant of OtterCookie, a cross-platform malware family that blends capabilities from both OtterCookie and BeaverTail. The campaign targets developers, job seekers, and individuals lured into fraudulent hiring pipelines.

The Contagious Interview campaign weaponizes:

North Korean threat groups have repeatedly targeted software engineers, blockchain developers, and individuals connected to cryptocurrency projects. npm is an attractive delivery channel due to its enormous install base and dependency chain complexity.

Cisco Talos and others previously documented infections linked to fake recruitment processes where victims were tricked into running Node.js applications that deployed OtterCookie.

Socket researchers identified 197 new npm packages tied to the campaign, including:

These packages pose as legitimate developer utilities but contain loader code designed to retrieve OtterCookie from a dedicated delivery infrastructure.

The packages connect to a hard-coded Vercel URL (tetrismic.vercel.app) that fetches the payload from a GitHub repository controlled by the attackers. The GitHub account stardev0914 has since been removed.

Once executed, the malicious npm package:

The malware supports:

The C2 communication fetches instructions from the attacker’s servers and maintains persistent control.

Researchers note significant overlap between OtterCookie and BeaverTail, suggesting the threat actors are merging toolsets across campaigns to optimize their operations.

The campaign parallels another DPRK-linked effort, ClickFake Interview, which distributes GolangGhost (FlexibleFerret/WeaselStore) via fake assessment websites. This malware disguises itself as camera/microphone troubleshooting tools and deploys:

This campaign targets individuals rather than enterprises, focusing on:

The stolen data—browser credentials, wallet seeds, documents, keystrokes—directly supports financial theft and long-term espionage.

npm ecosystems remain vulnerable to:

Given more than 31,000 downloads, exposure is widespread and global.

This is not a supply-chain operation targeting a single company—it’s a mass recruitment-themed attack pipeline designed to compromise individuals connected to high-value sectors. The campaign shows:

Unlike their IT worker impersonation schemes, Contagious Interview aims directly at individuals through staged hiring processes.

Researcher Kirill Boychenko emphasizes the campaign’s scale, noting its “prolific exploitation of npm” and its alignment with JavaScript and crypto-centric developer habits.

Validin analysts clarify that this campaign is distinct from broader DPRK IT worker infiltration:
Instead of placing operatives inside companies, Contagious Interview weaponizes the job application process itself, using malicious assessments and fraudulent platforms to compromise victims.