DependencyWatch.io
FeedSolutionsSubmitScan your lockfile
Feed
HighMalicious packagePublished 11 Feb 2026Updated 3 Oct 202632 packages · 44 versions

Lazarus "graphalgo" fake-recruiter campaign (npm + PyPI + Go)

Summary

ReversingLabs attributed an ongoing fake-recruiter campaign (active since May 2025, reported Feb 2026) to North Korea's Lazarus Group (overlapping Jade Sleet / UNC4899). Crypto, JavaScript, and Python developers are lured via LinkedIn/Reddit/Facebook into interview "coding tasks" that pull a token-protected RAT loader from npm and PyPI. ~192 malicious packages attributed in total; bigmathutils alone passed 10,000 downloads.

credential-theftinfostealercrypto-wallet-drain
Incident type
Malicious package. A package that was malicious from its first publish under its own name - a fake tool, a lure used in a social-engineering campaign, or a trojanised utility - rather than a copy of an existing name.
Threat actor
Lazarus Group (Jade Sleet / UNC4899)
Detected by
ReversingLabs
Also known as
Contagious Interview · Famous Chollima · fake recruiter campaign
Ecosystems
GonpmPyPI
Packages tracked
32

What happened

ReversingLabs published this attribution write-up on February 11, 2026, covering activity that had been running since at least May 2025. The cluster overlaps with what other vendors call Jade Sleet, UNC4899, and the Contagious Interview / Famous Chollima subsets of North Korea's broader Lazarus Group.

The social-engineering vector is the consistent thread: targets - typically crypto, Web3, JavaScript, or Python developers - are approached on LinkedIn, Reddit, or Facebook with a recruiter pitch. The "interview" includes a coding task hosted in a public repo. That repo pulls a private npm or PyPI dependency that the attacker controls, and the dependency carries a token-protected RAT loader. The token gate is the giveaway: it means casual npm install outside the live interview window resolves a clean package, so casual third-party inspection misses it.

ReversingLabs catalogued roughly 192 malicious packages across npm and PyPI in this cluster. bigmathutils alone passed 10,000 downloads - uncharacteristically high for a Contagious Interview package, suggesting it caught accidental installs from name-overlap with legitimate utilities. Most other packages stayed in the low double or triple digits, consistent with targeted delivery.

The stealer toolkit enumerates browser-wallet extensions (MetaMask, Phantom, etc.), exfiltrates seed material and credentials, and establishes a foothold for follow-on hands-on-keyboard work. Treat any unsolicited "coding task" repo as malware delivery and run installs in disposable sandboxes.

2026-10-03 update - Go module expansion attributed to the "Graphalgo campaign"

On 2026-10-02 the GitHub Advisory Database published two Go module advisories (gogets.dev/btreex GHSA-652v-q229-xvr4; gocommunity.io/orderedbtree GHSA-p3x3-hqg5-8pwf) explicitly naming the shared Graphalgo campaign and citing Aikido Security's coverage of Terraform and Go module threats in that cluster. The primitive is different from the earlier ReversingLabs-documented samples: both Go modules carry a second-stage RAT that beacons every 3-10 seconds via Ethereum smart-contract dead drops on the Arbitrum Sepolia network plus Slack bot tokens, with gogets.dev/btreex hiding its payload inside a ZIP file masquerading as btreex.sql triggered by a specific price integer value. The btree/orderedbtree/btreex naming shows the operator has expanded from the graph*/big*math naming to include data-structure utilities as a lure for Go developers.

Attribution caveat. The ReversingLabs Lazarus/Jade Sleet attribution is specific to the earlier npm + PyPI samples. GHSA uses the "Graphalgo campaign" name for these Go modules and ties them to the Aikido coverage, but a definitive link to Lazarus for the Go modules has not been publicly asserted by a vendor as of this update. The shared Graphalgo campaign name, the shared graph/data-structure lure shape, and the EtherHiding+Slack TTP that mirrors the Arbitrum Sepolia infrastructure in the Checkmarx-disclosed indexed-btree npm EtherHiding campaign (2026-09-17) are suggestive but not conclusive. Treat the Go modules as part of the broader Graphalgo cluster for lockfile-grep purposes; keep attribution to Lazarus narrow to the original ReversingLabs sample set.

Affected packages (32)

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once - it runs in your browser and nothing is uploaded.

Check package-lock.jsonCheck requirements.txt

Impact

  • MetaMask and other browser-wallet enumeration plus credential theft
  • Token-protected C2 enables targeted post-exploitation
  • Persistent foothold via interview tasks disguised as coding challenges

What to do

  1. 1Audit dependency trees for any package name in the graph* or big*math/num* families
  2. 2Treat unsolicited interview-task repos as malware delivery vehicles
  3. 3Run installs in disposable sandboxes when evaluating third-party challenges

References

Back to feedSubmit a correction
multi-2026-02-11-lazarus-graphalgo