Cybersecuritynews NPM Packages Distribute PylangGhost RAT in Supply Chain Attack
Article Content
- •Malicious npm packages are spreading the PylangGhost RAT, targeting multiple OS platforms.
- •The attack is linked to the North Korean state-sponsored group FAMOUS CHOLLIMA.
- •Developers are advised to check their npm packages for the compromised versions.
Malicious npm packages have been identified as vehicles for the PylangGhost remote access trojan (RAT), linked to North Korean state-sponsored group FAMOUS CHOLLIMA. The attack began with the release of compromised versions of the packages @jaime9008/math-service (1.0.1–1.0.2) in late February 2026, followed by react-refresh-update (1.0.1–1.0.4) on March 1, 2026. These packages target developers across Windows, Linux, and macOS systems. Earlier versions of these packages were found to be benign. The malware was first disclosed by Cisco Talos in June 2025, indicating a significant escalation in software supply chain attacks. Developers using these npm packages are at risk of unauthorized access to their systems. The current status of the attack is ongoing, with security professionals urged to remain vigilant.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (4)
Following this threat?
Track FAMOUS CHOLLIMA and PylangGhost in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
North Korean Fake IT Workers Infiltrate US Companies US authorities have revealed a network linked to North Korea that infiltrated approximately 70 US companies using fake employees. These operatives applied for remote IT positions, utilizing fabricated identities and sophisticated techniques to gain access to internal systems. The FBI has issued alerts highlighting the… 
US Disrupts North Korean Laptop Farms Generating $3 Million in Fraud The US Department of Justice has arrested two US nationals, Michael James Bostelle and Juan Cecilio Pena Carrillo, for their roles in a scheme that facilitated North Korean IT workers to obtain remote jobs at US companies using stolen identities. This operation, named 'Operation Lonestar Roundup', involved raids on…