Hunting North Korea’s State-Sponsored “Contagious Interview” Operation: Attacks on Developers via the Software Supply Chain

North Korean state-sponsored threat actors behind the “Contagious Interview” operation blend social engineering with malicious open source packages to compromise developers and tech job seekers. Throughout 2025, we identified and analyzed hundreds of malicious npm packages (thousands of downloads) delivering stealthy, multi-stage loaders and infostealers that fetch the BeaverTail malware and the InvisibleFerret backdoor.

Operators pose as recruiters on LinkedIn, deliver “coding assignments” via GitHub, Bitbucket, and Google Docs, and pressure targets to execute code locally. The activity spans hundreds of aliases and numerous C2 endpoints, with dozens of packages remaining live at disclosure and new uploads appearing continuously in the npm registry.