North Korean Hackers Deploy 197 npm Packages to Spread Updated OtterCookie Malware
Source Reddit InfoSec News
Description
North Korean threat actors have deployed 197 malicious npm packages to distribute an updated version of the OtterCookie malware. This malware campaign leverages the npm ecosystem to infect developers and organizations that use these packages, potentially compromising software supply chains. The updated OtterCookie malware is designed to exfiltrate sensitive data and maintain persistence on infected systems. Although no known exploits in the wild have been reported yet, the scale and sophistication of this campaign pose a significant risk. European organizations relying on npm packages for development are at risk of supply chain attacks, which can lead to data breaches and operational disruptions. Mitigation requires rigorous package vetting, use of software composition analysis tools, and restricting npm package usage to trusted sources. Countries with strong software development sectors and high npm usage, such as Germany, the UK, France, and the Netherlands, are likely to be most affected. Given the malware’s potential impact on confidentiality and integrity, ease of distribution via npm, and no authentication required for exploitation, the threat severity is assessed as high. Defenders should prioritize monitoring for suspicious npm package activity and implement strict supply chain security controls.