Social Engineering Campaign Targets Open Source Developers, Compromising npm Packages Used by Millions
What Happened – North‑Korean actors created a fake Slack workspace, cloned corporate identities and staged a bogus Microsoft Teams call to convince an Axios maintainer to install a remote‑access trojan masquerading as a software update. The foothold was used to inject malicious code into popular npm packages that are downloaded more than 100 million times per week. A new OpenSSF advisory confirms the same tactics are being applied to other high‑profile open‑source maintainers (Node.js, Mocha, Lodash, dotenv, WebTorrent, etc.).
Why It Matters for TPRM –
- Supply‑chain compromise of open‑source components can cascade to any downstream vendor that relies on those packages.
- Credential theft and root‑certificate injection give attackers persistent, network‑wide visibility into victim environments.
- The campaign demonstrates that “people‑first” attacks are now the primary vector against software‑supply‑chain risk.
Who Is Affected – Technology & SaaS firms, cloud‑native platforms, fintech, e‑commerce, and any organization that incorporates open‑source JavaScript libraries into production workloads.
Recommended Actions –
- Verify all communications with open‑source maintainers via out‑of‑band channels (e.g., MFA, signed emails).
- Enforce strict code‑signing and provenance checks for third‑party npm packages (SBOM, sigstore, npm audit).
- Deploy endpoint detection that flags unexpected RAT binaries and root‑certificate installations.
- Conduct developer‑focused security awareness training on social‑engineering tactics.
Technical Notes – Attack vector: phishing‑laced Slack/LinkedIn messages and spoofed video‑conferencing updates; exploitation of trust relationships to deliver a RAT and a malicious “Google certificate” that enables TLS interception. No public CVE associated; the malicious payload is a custom remote‑access trojan. Data types compromised include source code, developer credentials, and potentially downstream customer data embedded in compromised packages. Source: Help Net Security