# DPRK Contagious Interview campaign expands across 5 ecosystems

> Socket disclosed a fresh wave of DPRK Contagious Interview / FAMOUS CHOLLIMA packages spanning npm, PyPI, Go modules, crates.io, and Packagist. They impersonate logging / license developer tooling and act as staged loaders for credential stealers and RATs across Windows, macOS and Linux. The Windows variant deploys a keylogger and AnyDesk for hands-on access.

- Published: 2026-04-07
- Severity: high
- Kind: Typosquat - A package that never had a legitimate version, named to be mistaken for a real one - a misspelling, a lookalike scope, or an impersonated vendor SDK.
- Ecosystems: crates.io, Go, npm, Packagist, PyPI
- Scope: 14 packages, 6 compromised versions
- Tags: credential-theft, infostealer, typosquat, ci-cd-compromise
- Threat actor: Famous Chollima (DPRK)
- Also known as: Contagious Interview, CL-STA-0240
- Detected by: Socket
- Incident ID: multi-2026-04-07-contagious-interview-5-ecosystems

## Affected packages (14)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [apachelicense](https://dependencywatch.io/package/pypi/apachelicense) | PyPI | 0.1a1 |
| [debug-fmt](https://dependencywatch.io/package/npm/debug-fmt) | npm |  |
| [debug-glitz](https://dependencywatch.io/package/npm/debug-glitz) | npm |  |
| [dev-log-core](https://dependencywatch.io/package/npm/dev-log-core) | npm | 1.0.5 |
| [fluxhttp](https://dependencywatch.io/package/pypi/fluxhttp) | PyPI |  |
| [github.com/aokisasakidev/mit-license-pkg](https://dependencywatch.io/package/go/github.com/aokisasakidev/mit-license-pkg) | Go | 1.0.2 |
| [github.com/golangorg/formstash](https://dependencywatch.io/package/go/github.com/golangorg/formstash) | Go | 1.0.5 |
| [golangorg/logkit](https://dependencywatch.io/package/packagist/golangorg/logkit) | Packagist |  |
| [license-utils-kit](https://dependencywatch.io/package/pypi/license-utils-kit) | PyPI | 0.1rc3 |
| [logger-base](https://dependencywatch.io/package/npm/logger-base) | npm |  |
| [logkitx](https://dependencywatch.io/package/npm/logkitx) | npm |  |
| [logtrace](https://dependencywatch.io/package/crates/logtrace) | crates.io | 1.0.2 |
| [logutilkit](https://dependencywatch.io/package/pypi/logutilkit) | PyPI |  |
| [pino-debugger](https://dependencywatch.io/package/npm/pino-debugger) | npm |  |

## What happened

Socket disclosed a fresh wave of the DPRK **Contagious Interview** campaign on 7 April 2026, spanning five package ecosystems simultaneously: **npm, PyPI, Go modules, crates.io and Packagist**. Socket's tracker now attributes more than 1,700 malicious packages to the cluster since 2024, including a prior wave of 338 npm packages.

The packages impersonate logging utilities, debug helpers and licence-management tooling - categories developers grab without scrutiny. They act as staged loaders for credential stealers and remote-access trojans across Windows, macOS and Linux. The Windows variant additionally deploys a keylogger and installs **AnyDesk** for hands-on-keyboard access.

Threat-actor personas behind the publishers include `golangorg`, `aokisasakidev` / `aokisasakidev1`, and `maxcointech1010` / `maxcointech0000`, with registration emails like `aokisasaki1122@gmail.com` and `shiningup1996@gmail.com`. Distribution still relies on fake job lures: contractors and developers in crypto, blockchain and AI are messaged with "interview task" repositories that pull these packages as dependencies.

Key IOCs:

- C2 / delivery: `apachelicense.vercel.app`, `ngrok-free.vercel.app`, `logkit.onrender.com`, `logkit-tau.vercel.app`, `66.45.225.94`.
- Stage-2 hashes - Linux `9a541dffb7fc18dc71dbc8523ec6c3a71c224ffeb518ae3a8d7d16377aebee58`, macOS `bb2a89001410fa5a11dea6477d4f5573130261badc67fe952cfad1174c2f0edd`, Windows `7c5adef4b5aee7a4aa6e795a86f8b7d601618c3bc003f1326ca57d03ec7d6524`.

Attribution to **Famous Chollima** (overlapping with the broader Lazarus umbrella) is consistent across Socket, Microsoft, Mandiant and Crowdstrike reporting.

## Impact

- Cross-ecosystem coverage means one campaign can hit nearly any developer stack
- Windows variant deploys keylogger and AnyDesk for hands-on access
- Targets crypto, blockchain and AI developers via fake job lures

## What to do

1. Block listed C2s (apachelicense.vercel.app, logkit.onrender.com, logkit-tau.vercel.app, 66.45.225.94)
2. Remove any of the named packages and rotate credentials
3. Treat unsolicited contractor / interview-task repos as malware delivery

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [Contagious Interview campaign spreads across 5 ecosystems](https://socket.dev/blog/contagious-interview-campaign-spreads-across-5-ecosystems) - Socket

---

Canonical page: https://dependencywatch.io/incident/multi-2026-04-07-contagious-interview-5-ecosystems
Markdown version: https://dependencywatch.io/incident/multi-2026-04-07-contagious-interview-5-ecosystems.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).