# StegaBin: 26 npm typosquats use Pastebin steganography to deliver Contagious Interview RAT > Socket disclosed 26 typosquatted npm packages tied to North Korea's Contagious Interview / FAMOUS CHOLLIMA cluster. The loader decodes steganographically-encoded Pastebin URLs to resolve C2 hosted across 31 Vercel deployments, then retrieves a 9-module infostealer and RAT toolkit. - Published: 2026-02-27 - Severity: high - Kind: Typosquat - A package that never had a legitimate version, named to be mistaken for a real one - a misspelling, a lookalike scope, or an impersonated vendor SDK. - Ecosystems: npm - Scope: 26 packages, 26 compromised versions - Tags: typosquat, infostealer, credential-theft, obfuscation, crypto-wallet-drain - Threat actor: Famous Chollima (DPRK Contagious Interview) - Also known as: StegaBin, Contagious Interview, Famous Chollima - Detected by: Socket - Incident ID: npm-2026-02-27-stegabin-contagious-interview ## Affected packages (26) Only the exact versions listed were named by the source advisories. Other versions are not implicated. | Package | Ecosystem | Compromised versions | |---|---|---| | [argonist](https://dependencywatch.io/package/npm/argonist) | npm | 0.41.0 | | [bcryptance](https://dependencywatch.io/package/npm/bcryptance) | npm | 6.5.2 | | [bee-quarl](https://dependencywatch.io/package/npm/bee-quarl) | npm | 2.1.2 | | [bubble-core](https://dependencywatch.io/package/npm/bubble-core) | npm | 6.26.2 | | [corstoken](https://dependencywatch.io/package/npm/corstoken) | npm | 2.14.7 | | [daytonjs](https://dependencywatch.io/package/npm/daytonjs) | npm | 1.11.20 | | [ether-lint](https://dependencywatch.io/package/npm/ether-lint) | npm | 5.9.4 | | [expressjs-lint](https://dependencywatch.io/package/npm/expressjs-lint) | npm | 5.3.2 | | [fastify-lint](https://dependencywatch.io/package/npm/fastify-lint) | npm | 5.8.0 | | [formmiderable](https://dependencywatch.io/package/npm/formmiderable) | npm | 3.5.7 | | [hapi-lint](https://dependencywatch.io/package/npm/hapi-lint) | npm | 19.1.2 | | [iosysredis](https://dependencywatch.io/package/npm/iosysredis) | npm | 5.13.2 | | [jslint-config](https://dependencywatch.io/package/npm/jslint-config) | npm | 10.22.2 | | [jsnwebapptoken](https://dependencywatch.io/package/npm/jsnwebapptoken) | npm | 8.40.2 | | [kafkajs-lint](https://dependencywatch.io/package/npm/kafkajs-lint) | npm | 2.21.3 | | [loadash-lint](https://dependencywatch.io/package/npm/loadash-lint) | npm | 4.17.24 | | [mqttoken](https://dependencywatch.io/package/npm/mqttoken) | npm | 5.40.2 | | [prism-lint](https://dependencywatch.io/package/npm/prism-lint) | npm | 7.4.2 | | [promanage](https://dependencywatch.io/package/npm/promanage) | npm | 6.0.21 | | [sequelization](https://dependencywatch.io/package/npm/sequelization) | npm | 6.40.2 | | [typoriem](https://dependencywatch.io/package/npm/typoriem) | npm | 0.4.17 | | [undicy-lint](https://dependencywatch.io/package/npm/undicy-lint) | npm | 7.23.1 | | [uuindex](https://dependencywatch.io/package/npm/uuindex) | npm | 13.1.0 | | [vitetest-lint](https://dependencywatch.io/package/npm/vitetest-lint) | npm | 4.1.21 | | [windowston](https://dependencywatch.io/package/npm/windowston) | npm | 3.19.2 | | [zoddle](https://dependencywatch.io/package/npm/zoddle) | npm | 4.4.2 | ## What happened StegaBin is Socket's name for a 26-package npm campaign published in late February 2026 and attributed to North Korea's **Contagious Interview** / **Famous Chollima** cluster. The package names are typosquats of popular libraries - `fastify-lint`, `expressjs-lint`, `loadash-lint`, `prism-lint`, and so on - with single-character or suffix variations chosen to catch typo or autocomplete installs. The novel piece is the resolver: the loader pulls a Pastebin page where the C2 host is encoded steganographically (zero-width whitespace and Base64-in-comments), so simple HTTP traffic analysis sees only a Pastebin fetch. Decoded, the URL points to one of 31 rotating `*.vercel.app` deployments that serve a 9-module infostealer and RAT toolkit. Once running, the malware enumerates browser stores (Chrome / Edge / Brave), pulls cookies and saved credentials, harvests SSH keys and Git configs, and runs `TruffleHog`-style scanning across disk to find further secret material. Crypto wallet extensions are a priority target. On Windows, it stages **AnyDesk** for hands-on follow-up and installs a keylogger. Socket identified C2 IP `103.106.67.63` and the Vercel deployment list. Block both at egress, hunt for AnyDesk and keylogger artefacts on Windows developer hosts, and rotate any credential reachable from a host that resolved one of the 26 packages. ## Impact - Browser credentials, crypto wallets, SSH and Git secrets exfiltrated - TruffleHog-style scanning runs on victim disk to find more secrets - Resilient C2 via rotating Vercel deployments + Pastebin dead-drops ## What to do 1. Remove any of the 26 listed packages and rotate impacted credentials 2. Block C2 IP 103.106.67.63 and listed Vercel domains at egress 3. Hunt for AnyDesk and keylogger artefacts on Windows dev hosts ## Check your own dependencies - Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json The scan runs entirely in the browser; lockfile contents are never uploaded. ## References - [Socket: StegaBin - 26 malicious npm packages use Pastebin steganography](https://socket.dev/blog/stegabin-26-malicious-npm-packages-use-pastebin-steganography) - Socket --- Canonical page: https://dependencywatch.io/incident/npm-2026-02-27-stegabin-contagious-interview Markdown version: https://dependencywatch.io/incident/npm-2026-02-27-stegabin-contagious-interview.md Site index for agents: https://dependencywatch.io/llms.txt DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).