Back Cybersecuritynews

Malicious npm Packages Deliver PylangGhost RAT in New Software Supply Chain Campaign

Cybersecuritynews •Tushar Subhra Dutta • March 17, 2026

A remote access trojan known as PylangGhost has appeared on the npm registry for the first time, concealed inside two malicious JavaScript packages. The malware, first publicly disclosed by Cisco Talos in June 2025 and attributed to the North Korean state- threat group FAMOUS CHOLLIMA, marks a significant escalation in software supply chain attacks targeting […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

NPM Packages Distribute PylangGhost RAT in Supply Chain Attack Malicious npm packages have been identified as vehicles for the PylangGhost remote access trojan (RAT), linked to North Korean state-sponsored group FAMOUS CHOLLIMA. The attack began with the release of compromised versions of the packages @jaime9008/math-service (1.0.1–1.0.2) in late February 2026, followed by react-refresh-update (1.0.1–1.0.4) on March 1, 2026. These packages target developers across Windows, Linux, and macOS systems. Earlier versions of these packages were found to be benign. The malware was first disclosed by Cisco Talos in June 2025, indicating a significant escalation in software supply chain attacks. Developers using these npm packages are at risk of unauthorized access to their systems. The current status of the attack is ongoing, with security professionals urged to remain vigilant. 4 sources 77

Extracted Entities

Malicious npm Packages Deliver PylangGhost RAT in New Software Supply Chain Campaign

The full story

Extracted Entities

APT Groups (1)

Attack Types (2)

Malware (1)

MITRE ATT&CK (1)

Tools (1)