Back Nknews

North Korean hackers expand supply chain attack campaign across ecosystems

Nknews • July 3, 2026

Campaign targeting developers could allow attackers to steal credentials and set up further attacks, researchers warn

Shreyas Reddy July 3, 2026

North Korean-linked cybercriminals have expanded a long-running campaign targeting software supply chains across multiple open-source software ecosystems, exposing software developers and organizations that rely on open-source software packages to a broader range of attacks.

In a report published Wednesday, U.S. security firm Socket said it identified 162 malicious release artifacts across 108 packages and browser extensions tied to the “PolinRider” campaign, which it linked to North Korea’s broader Contagious Interview operation targeting developers.

While some of the attack techniques have appeared in North Korean campaigns, researchers said the operation has significantly broadened its reach

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Mini Shai-Hulud Supply Chain Attack Targets SAP npm Packages A new supply chain attack, dubbed 'Mini Shai-Hulud', has compromised multiple npm packages related to SAP's Cloud Application Programming Model (CAP). This attack involves injecting malicious preinstall scripts into legitimate packages, which execute during installation to steal sensitive credentials from developers and CI/CD environments. The malware collects data such as GitHub tokens, npm credentials, and cloud secrets, exfiltrating them via public GitHub repositories. Researchers have linked this campaign to the TeamPCP threat actor group, known for similar tactics in previous attacks. At least four SAP-related npm packages have been confirmed as compromised, with the malicious payload being designed to propagate further across the npm ecosystem. The attack is ongoing, and organizations are advised to review their environments for affected packages and rotate any exposed secrets. 545 sources 71

Extracted Entities

North Korean hackers expand supply chain attack campaign across ecosystems

The full story

Extracted Entities

Attack Types (1)

Campaigns (2)

Countries (1)

MITRE ATT&CK (1)