The Contagious Interview campaign is a North Korean supply chain attack operation that distributes malicious packages across five popular software package ecosystems (npm, PyPI, Go Modules, crates.io, and Packagist). The attackers use GitHub aliases such as golangorg and aokisasakidev to publish staged malware loaders disguised as legitimate developer tooling libraries. These loaders contact attacker-controlled infrastructure to download second-stage malware payloads hosted on Google Drive. The malicious code is hidden behind seemingly normal API functions in logging and utility libraries. Windows variants of the malware include full-featured remote access trojans with capabilities including shell command execution, keylogging, theft of browser data and cryptocurrency wallets, collection of sensitive files, and installation of AnyDesk for remote access. The campaign is notable for its cross-ecosystem coordination, reuse of extraction directories, and consistent staging logic across different programming languages. There is no CVE or patch information available, and no known active exploitation has been reported.

If successfully integrated into a developer's environment, these malicious packages can lead to remote compromise of affected systems, including unauthorized shell access, credential theft, keylogging, theft of cryptocurrency wallets, and sensitive data exfiltration. The deployment of AnyDesk enables persistent remote control by the attacker. The cross-ecosystem nature increases the risk of widespread impact across diverse development environments. However, no known exploits in the wild have been confirmed at this time.

Patch status is not yet confirmed — check the vendor advisory and ecosystem-specific security advisories for current remediation guidance. Developers should verify the authenticity and integrity of packages before use, avoid installing packages from untrusted sources or suspicious GitHub aliases, and monitor for indicators of compromise such as the provided hashes and domains. Since this is a supply chain attack involving multiple ecosystems, organizations should consider implementing supply chain security best practices such as dependency auditing and restricting package sources. No official fixes or vendor advisories are currently available.