Back Gbhackers

Malicious NPM Packages Spread PylangGhost RAT in Supply Chain Attack

Gbhackers •Mayura Kathir • March 17, 2026

Malicious npm packages are delivering the North Korean–linked PylangGhost remote access trojan (RAT) in a new software supply chain campaign that targets developers across Windows, Linux, and macOS systems. The first malicious versions appeared in late February 2026 (@jaime9008/math-service 1.0.1–1.0.2), followed by react-refresh-update 1.0.1–1.0.4 published on March 1, 2026. Earlier 1.0.0 versions in both families were benign, a […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

NPM Packages Distribute PylangGhost RAT in Supply Chain Attack Malicious npm packages have been identified as vehicles for the PylangGhost remote access trojan (RAT), linked to North Korean state-sponsored group FAMOUS CHOLLIMA. The attack began with the release of compromised versions of the packages @jaime9008/math-service (1.0.1–1.0.2) in late February 2026, followed by react-refresh-update (1.0.1–1.0.4) on March 1, 2026. These packages target developers across Windows, Linux, and macOS systems. Earlier versions of these packages were found to be benign. The malware was first disclosed by Cisco Talos in June 2025, indicating a significant escalation in software supply chain attacks. Developers using these npm packages are at risk of unauthorized access to their systems. The current status of the attack is ongoing, with security professionals urged to remain vigilant. 4 sources 77

Extracted Entities

Malicious NPM Packages Spread PylangGhost RAT in Supply Chain Attack

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (3)

Tools (2)