North Korean Hackers Target Developers, Injecting Malware into Software Supply Chain
A North Korean-aligned group, DeceptiveDevelopment, is now stealing developer credentials to inject malware into software packages on platforms like npm, Go modules, and PyPI.
A North Korea-aligned hacking group, tracked as DeceptiveDevelopment, has shifted its tactics to steal developer credentials, enabling them to inject malware directly into trusted software projects. Between April and September 2026, the group leveraged compromised Git logins and cloud keys to alter code in both public and private repositories. This new approach significantly amplifies their potential impact, as a single infected developer can now expose dozens or even hundreds of downstream users to risk.
ESET researchers detailed this evolution in their APT Activity Report, noting that the group moved from earlier methods like fake job interviews and coding challenges to broader software supply-chain compromises. The attack typically begins with a lure, such as a fake hiring task requiring a developer to run a project. Once the developer executes the malicious file, malware on their machine harvests Git credentials, SSH keys, and access tokens. The attackers then use this stolen access to log in as the developer and insert malicious code into the victim's repositories, often rewriting commit history to conceal their actions.
The poisoned software packages were found on various platforms including npm, the Go module mirror, Packagist, PyPI, and browser extension marketplaces. The majority of compromised projects were small, single-developer tools, suggesting an automated spread rather than highly targeted attacks. Each compromised project then served as a new entry point for anyone who downloaded it, creating a cascading effect of infections.
ESET identified two primary tools used in these campaigns: OmniStealer, a Python infostealer that targets browser logins, crypto wallets, password managers, and developer secrets, and DEV#POPPER, a Node.js remote access trojan. Newer versions of DEV#POPPER have been observed embedding themselves into frequently used developer applications like VS Code, Cursor, and Discord, ensuring the malware runs each time these applications are launched.
DeceptiveDevelopment has also implemented sophisticated techniques to maintain resilient command-and-control (C2) infrastructure. They are utilizing blockchain transactions, specifically by reading C2 server IP addresses from the recipient field of Ethereum transfers. This method, publicly known as NullReceiver, allows attackers to switch C2 servers with a single blockchain transaction without needing to update any packages, making their infrastructure extremely difficult to disrupt. This marks the first observed instance of blockchain-based server lookup being directly integrated into a GitHub-hosted project.
Furthermore, the group has shifted its lures and payloads to platforms that are harder to take down. Early-stage lures were hosted on self-hosted Gitea instances, bypassing central reporting mechanisms. Later-stage payloads were stored on services like JSONBin.io, JSONHosting, and Pinata (an IPFS gateway), where files are content-addressed, making removal difficult even if an account is closed.
ESET's analysis indicates that these six months were used to expand their victim base and increase the difficulty of takedowns. The adoption of blockchain for C2 infrastructure is a notable escalation, and other threat groups are reportedly copying this approach. Developers are advised to practice good security hygiene, including never running untrusted code on work machines, rotating credentials regularly, reviewing commit histories for suspicious changes, and treating unexpected blockchain traffic from build systems as a potential warning sign.