Phemex

GoPlus Alerts on 26 Malware Packages from North Korean Hackers

First seen 3 Mar 2026, 11:09 UTC • Panewslab

•79% similarity •30.6

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

GoPlus has issued a warning regarding 26 malware packages released by North Korean hackers on the npm registry. These packages include an installation script that executes malicious code, which downloads and runs a Remote Access Trojan (RAT). Users of the npm registry are advised to be cautious and avoid these packages.

ThreatCluster AI How this analysis works

Timeline

2026-03-03

GoPlus issues warning about 26 malware packages

2026-03-03

Malicious code identified in 'vendor/scrypt-js/version.js'

2026-03-03

Remote Access Trojan (RAT) downloaded via malicious URL

Attack Flow

11 entities, 10 inferred relationships (STIX 2.1).

Threat Actor (1)

FAMOUS CHOLLIMA

Technique (8)

Malware
Supply Chain Attack
T1003 - OS Credential Dumping
T1056.001 - Keylogging
T1059.007 - JavaScript
T1105 - Ingress Tool Transfer
T1115 - Clipboard Data
T1195 - Supply Chain Compromise

Affected Platform (1)

Npm Registry

Tool (1)

TruffleHog

Relationships

FAMOUS CHOLLIMA uses TruffleHog
FAMOUS CHOLLIMA uses Malware
FAMOUS CHOLLIMA uses Supply Chain Attack
FAMOUS CHOLLIMA uses T1003 - OS Credential Dumping
FAMOUS CHOLLIMA uses T1056.001 - Keylogging
FAMOUS CHOLLIMA uses T1059.007 - JavaScript
FAMOUS CHOLLIMA related to T1105 - Ingress Tool Transfer
FAMOUS CHOLLIMA related to T1115 - Clipboard Data
FAMOUS CHOLLIMA related to T1195 - Supply Chain Compromise
FAMOUS CHOLLIMA related to Npm Registry

Community

Browse all →

Tracked Entities in This Story

FAMOUS CHOLLIMA Npm Registry

GoPlus Alerts on 26 Malware Packages from North Korean Hackers

Ask AI about this cluster

Article Content

Timeline

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading

Tracked Entities in This Story