North Korea’s Lazarus Group Targets Crypto Developers With Six Malicious NPM Packages

On March 10, 2025, the Socket Research Team uncovered a new campaign by North Korea’s Lazarus Group that injected six malicious npm packages into the JavaScript ecosystem. The packages—is-buffer-validator, yoojae-validator, event-handle-package, array-empty-validator, react-event-dependency, and auth-validator—were collectively downloaded over 330 times before being removed from the registry. Each package contained malware designed to steal browser credentials, harvest cryptocurrency wallet data, and deploy persistent backdoors on infected machines.

The Threat Landscape

This is far from an isolated incident. The Lazarus Group, a state-sponsored hacking unit tied to North Korea’s Reconnaissance General Bureau, has been systematically targeting the cryptocurrency ecosystem for years. Their campaigns have evolved from direct exchange hacks to sophisticated supply chain attacks that exploit the trust developers place in open-source package registries like npm, PyPI, and GitHub.

The six packages identified in this campaign closely mirror tactics previously documented in Lazarus “Contagious Interview” operations. They employ typosquatting—mimicking legitimate, commonly used JavaScript packages—to trick developers into installing them. Once installed, the packages execute BeaverTail malware, which serves as the first stage of a two-part infection chain. BeaverTail extracts browser-stored credentials, cookies, and cryptocurrency wallet information before downloading and deploying the InvisibleFerret backdoor for persistent access.

The timing is notable: this campaign emerged just weeks after the Lazarus Group was linked to the $1.4 billion Bybit hack, the largest cryptocurrency theft in history. That attack compromised a developer’s laptop to inject malicious JavaScript into Safe{Wallet} infrastructure. The npm campaign represents the same group expanding their attack surface to target individual developers.

Core Principles

Supply chain security in the JavaScript ecosystem rests on several fundamental principles. First, package provenance matters. Developers must verify that packages come from trusted, verified publishers. Second, behavioral analysis is essential—packages should be evaluated not just by their code but by what they actually do at runtime. Third, the principle of least privilege should govern package permissions: a validation library has no business accessing browser credentials or filesystem paths.

The crypto industry’s rapid growth has created a fertile hunting ground for Lazarus. With Bitcoin trading at approximately $78,500 and the total crypto market cap exceeding $3 trillion, the financial incentives for state-sponsored theft are enormous. The group’s operations have become increasingly sophisticated, blending social engineering, supply chain compromise, and advanced malware deployment.

Tooling and Setup

Protecting against supply chain attacks requires a layered defense strategy. Developers should implement automated dependency scanning using tools like Socket, Snyk, or npm audit in their CI/CD pipelines. These tools can detect known malicious packages, identify suspicious behavioral patterns, and flag packages with anomalous access patterns.

Package pinning is another critical practice. By locking exact package versions in lockfiles and avoiding auto-updating to the latest version, teams reduce the window of exposure to newly published malicious packages. Regular security audits of dependency trees help identify transitive dependencies that may introduce vulnerabilities.

For cryptocurrency-focused development teams, additional measures are warranted. Hardware security keys for signing operations, air-gapped machines for handling sensitive keys, and network segmentation that isolates development environments from production wallets all reduce the attack surface.

Ongoing Vigilance

The Lazarus Group’s npm campaign demonstrates that open-source ecosystems remain a weak link in the cryptocurrency security chain. The combination of 778,531 cryptocurrency wallet addresses compromised by the MassJacker malware (discovered the same week) and the Lazarus npm campaign paints a troubling picture of an industry under sustained, sophisticated attack.

Security is not a destination but a continuous process. The packages identified in this campaign were removed, but the next campaign is likely already in development. Organizations must invest in proactive threat detection, developer security training, and automated tools that can identify and block malicious dependencies before they enter the development pipeline.

Final Takeaway

The Lazarus Group’s sustained campaign against the cryptocurrency ecosystem through npm supply chain attacks represents a new frontier in cyber conflict. State-sponsored groups are targeting individual developers as a pathway to institutional funds. The crypto industry must treat supply chain security with the same rigor it applies to smart contract auditing and key management. Every npm install is a potential attack vector, and the industry cannot afford to treat dependency management as an afterthought.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Always conduct your own research before making any financial decisions.