# Lazarus "graphalgo" fake-recruiter campaign (npm + PyPI + Go) > ReversingLabs attributed an ongoing fake-recruiter campaign (active since May 2025, reported Feb 2026) to North Korea's Lazarus Group (overlapping Jade Sleet / UNC4899). Crypto, JavaScript, and Python developers are lured via LinkedIn/Reddit/Facebook into interview "coding tasks" that pull a token-protected RAT loader from npm and PyPI. ~192 malicious packages attributed in total; bigmathutils alone passed 10,000 downloads. - Published: 2026-02-11 - Last updated: 2026-10-03 - Severity: high - Kind: Malicious package - A package that was malicious from its first publish under its own name - a fake tool, a lure used in a social-engineering campaign, or a trojanised utility - rather than a copy of an existing name. - Ecosystems: Go, npm, PyPI - Scope: 32 packages, 44 compromised versions - Tags: credential-theft, infostealer, crypto-wallet-drain - Threat actor: Lazarus Group (Jade Sleet / UNC4899) - Also known as: Contagious Interview, Famous Chollima, fake recruiter campaign - Detected by: ReversingLabs - Incident ID: multi-2026-02-11-lazarus-graphalgo ## Affected packages (32) Only the exact versions listed were named by the source advisories. Other versions are not implicated. | Package | Ecosystem | Compromised versions | |---|---|---| | [bigmathex](https://dependencywatch.io/package/npm/bigmathex) | npm | | | [bigmathix](https://dependencywatch.io/package/npm/bigmathix) | npm | | | [bigmathlib](https://dependencywatch.io/package/npm/bigmathlib) | npm | | | [bigmathutils](https://dependencywatch.io/package/npm/bigmathutils) | npm | 1.0.0, 1.1.0 | | [bignumberx](https://dependencywatch.io/package/npm/bignumberx) | npm | | | [bignumex](https://dependencywatch.io/package/npm/bignumex) | npm | | | [bignumx](https://dependencywatch.io/package/npm/bignumx) | npm | | | [bigpyx](https://dependencywatch.io/package/pypi/bigpyx) | PyPI | | | [gocommunity.io/orderedbtree](https://dependencywatch.io/package/go/gocommunity.io/orderedbtree) | Go | | | [gogets.dev/btreex](https://dependencywatch.io/package/go/gogets.dev/btreex) | Go | | | [graphalgo](https://dependencywatch.io/package/npm/graphalgo) | npm | 2.2.5-pre, 2.2.6, 2.2.7, 2.2.8, 2.2.9, 2.2.10, 2.2.11 | | [graphalgo-py](https://dependencywatch.io/package/pypi/graphalgo-py) | PyPI | 3.5.1rc0.dev0, 3.5.2, 3.5.3, 3.5.5, 3.5.6 | | [graphchain](https://dependencywatch.io/package/npm/graphchain) | npm | | | [graphdict](https://dependencywatch.io/package/pypi/graphdict) | PyPI | | | [graphex](https://dependencywatch.io/package/pypi/graphex) | PyPI | 3.5.7, 3.5.8, 3.5.9, 3.5.10 | | [graphflowx](https://dependencywatch.io/package/npm/graphflowx) | npm | | | [graphflux](https://dependencywatch.io/package/npm/graphflux) | npm | | | [graphhub](https://dependencywatch.io/package/npm/graphhub) | npm | | | [graphkitx](https://dependencywatch.io/package/npm/graphkitx) | npm | | | [graphlibcore](https://dependencywatch.io/package/npm/graphlibcore) | npm | 2.2.6, 2.2.7, 2.2.8, 2.2.9, 2.2.10, 2.2.11 | | [graphlibx](https://dependencywatch.io/package/pypi/graphlibx) | PyPI | | | [graphnet](https://dependencywatch.io/package/npm/graphnet) | npm | | | [graphnetworkx](https://dependencywatch.io/package/npm/graphnetworkx) | npm | 2.1.6, 2.1.7, 2.1.8, 2.1.9, 2.1.10, 2.1.11 | | [graphnode](https://dependencywatch.io/package/pypi/graphnode) | PyPI | | | [graphorbit](https://dependencywatch.io/package/npm/graphorbit) | npm | | | [graphorithm](https://dependencywatch.io/package/npm/graphorithm) | npm | 2.2.6, 2.2.7, 2.2.8, 2.2.9 | | [graphrix](https://dependencywatch.io/package/npm/graphrix) | npm | | | [graphstruct](https://dependencywatch.io/package/npm/graphstruct) | npm | 2.2.6, 2.2.7, 2.2.8 | | [graphsync](https://dependencywatch.io/package/pypi/graphsync) | PyPI | | | [netstruct](https://dependencywatch.io/package/npm/netstruct) | npm | 2.1.6, 2.1.8 | | [terminal-kleur](https://dependencywatch.io/package/npm/terminal-kleur) | npm | | | [terminalcolor256](https://dependencywatch.io/package/npm/terminalcolor256) | npm | 2.0.2, 2.0.3, 2.1.0, 2.2.0, 2.2.6 | ## What happened ReversingLabs published this attribution write-up on February 11, 2026, covering activity that had been running since at least May 2025. The cluster overlaps with what other vendors call **Jade Sleet**, **UNC4899**, and the **Contagious Interview** / **Famous Chollima** subsets of North Korea's broader Lazarus Group. The social-engineering vector is the consistent thread: targets - typically crypto, Web3, JavaScript, or Python developers - are approached on LinkedIn, Reddit, or Facebook with a recruiter pitch. The "interview" includes a coding task hosted in a public repo. That repo pulls a private npm or PyPI dependency that the attacker controls, and the dependency carries a token-protected RAT loader. The token gate is the giveaway: it means casual `npm install` outside the live interview window resolves a clean package, so casual third-party inspection misses it. ReversingLabs catalogued roughly 192 malicious packages across npm and PyPI in this cluster. `bigmathutils` alone passed 10,000 downloads - uncharacteristically high for a Contagious Interview package, suggesting it caught accidental installs from name-overlap with legitimate utilities. Most other packages stayed in the low double or triple digits, consistent with targeted delivery. The stealer toolkit enumerates browser-wallet extensions (MetaMask, Phantom, etc.), exfiltrates seed material and credentials, and establishes a foothold for follow-on hands-on-keyboard work. Treat any unsolicited "coding task" repo as malware delivery and run installs in disposable sandboxes. ## 2026-10-03 update - Go module expansion attributed to the "Graphalgo campaign" On 2026-10-02 the GitHub Advisory Database published two Go module advisories (`gogets.dev/btreex` GHSA-652v-q229-xvr4; `gocommunity.io/orderedbtree` GHSA-p3x3-hqg5-8pwf) explicitly naming the shared **Graphalgo campaign** and citing Aikido Security's coverage of Terraform and Go module threats in that cluster. The primitive is different from the earlier ReversingLabs-documented samples: both Go modules carry a second-stage RAT that beacons every 3-10 seconds via Ethereum smart-contract dead drops on the **Arbitrum Sepolia** network plus Slack bot tokens, with `gogets.dev/btreex` hiding its payload inside a ZIP file masquerading as `btreex.sql` triggered by a specific price integer value. The `btree`/`orderedbtree`/`btreex` naming shows the operator has expanded from the `graph*`/`big*math` naming to include data-structure utilities as a lure for Go developers. **Attribution caveat.** The ReversingLabs Lazarus/Jade Sleet attribution is specific to the earlier npm + PyPI samples. GHSA uses the "Graphalgo campaign" name for these Go modules and ties them to the Aikido coverage, but a definitive link to Lazarus for the Go modules has not been publicly asserted by a vendor as of this update. The shared `Graphalgo` campaign name, the shared graph/data-structure lure shape, and the EtherHiding+Slack TTP that mirrors the Arbitrum Sepolia infrastructure in the Checkmarx-disclosed [`indexed-btree` npm EtherHiding campaign (2026-09-17)](https://dependencywatch.io/incident/npm-2026-09-17-indexed-btree-sepolia-etherhiding) are suggestive but not conclusive. Treat the Go modules as part of the broader Graphalgo cluster for lockfile-grep purposes; keep attribution to Lazarus narrow to the original ReversingLabs sample set. ## Impact - MetaMask and other browser-wallet enumeration plus credential theft - Token-protected C2 enables targeted post-exploitation - Persistent foothold via interview tasks disguised as coding challenges ## What to do 1. Audit dependency trees for any package name in the `graph*` or `big*math/num*` families 2. Treat unsolicited interview-task repos as malware delivery vehicles 3. Run installs in disposable sandboxes when evaluating third-party challenges ## Check your own dependencies - Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json - Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt The scan runs entirely in the browser; lockfile contents are never uploaded. ## References - [ReversingLabs: Fake-recruiter campaign hits crypto devs](https://www.reversinglabs.com/blog/fake-recruiter-campaign-crypto-devs) - ReversingLabs - [GHSA-652v-q229-xvr4 - Go module gogets.dev/btreex (Graphalgo campaign expansion, Ethereum smart contract + Slack bot token RAT, 2026-10-02)](https://github.com/advisories/GHSA-652v-q229-xvr4) - GitHub - [GHSA-p3x3-hqg5-8pwf - Go module gocommunity.io/orderedbtree (Graphalgo campaign expansion, Arbitrum Sepolia EtherHiding + Slack bot token, 2026-10-02)](https://github.com/advisories/GHSA-p3x3-hqg5-8pwf) - GitHub --- Canonical page: https://dependencywatch.io/incident/multi-2026-02-11-lazarus-graphalgo Markdown version: https://dependencywatch.io/incident/multi-2026-02-11-lazarus-graphalgo.md Site index for agents: https://dependencywatch.io/llms.txt DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).