1,700+
Malicious packages identified since Jan 2025
Socket, April 2026
100M
Axios downloads/week at the time of compromise
Snyk, March 31, 2026
3 hours
Window between axios 1.14.1 publication and npm removal
Snyk timeline
The context
The operation is called Contagious Interview. The first infrastructure was detected in 2022, the first public report came out in November 2023 from Unit 42 (Palo Alto Networks). Since then, the pace has been accelerating.
According to the Socket report presented in April 2026 at the SANS CTI Summit by Kir Boyenko (Senior Threat Intelligence Analyst), the campaign has published more than 1,700 malicious packages across npm, PyPI, Go, Rust and PHP since January 2025. Attribution is unanimous between Mandiant (Google Cloud), CrowdStrike and Recorded Future Insikt Group: it's UNC1069, also tracked as BlueNoroff, Sapphire Sleet or Stardust Chollima, a financial sub-group of the well-known Lazarus group.
What makes this attack dangerous for an SMB or an agency shipping JavaScript: it's not a patch to apply. It's long-form social engineering, paired with an npm package that does exactly what its README promises, except it also does something else. And the malicious code is not in a postinstall script flashing red - it's embedded in a function that looks like the package's domain (logger, validator, debug helper).
2022
First Contagious Interview infrastructure
Detected retroactively by researchers. The campaign is already active but not yet public.
November 2023
First public report (Unit 42, Palo Alto)
The operation is named and attributed to North Korea. BeaverTail/InvisibleFerret malware stack documented.
January 2025
Socket count begins
Starting point for the 1,700+ package tally. The cadence becomes weekly and automated.
November 2025
Wave of 197 OtterCookie packages
Published over a few days on npm. 31,000+ downloads before removal.
March 31, 2026
Axios compromise (3 hours)
axios@1.14.1 and axios@0.30.4 published with plain-crypto-js@4.2.1 as a malicious dependency. Socket detection in 6 minutes, final removal at 03:29 UTC.
April 2026
SANS CTI Summit presentation
Socket publishes 'Hunting Contagious Interview'. 1,700+ packages confirmed, cross-ecosystem (npm, PyPI, Go, Rust, PHP).
How the attack unfolds
The 5 phases come up in every public report. It's a stable but well-rehearsed playbook.
The Contagious Interview playbook
1. Contact (LinkedIn, Telegram, Slack)
A recruiter writes to you about a Software Engineer position at a crypto/Web3 company. The profile looks clean, the company has a LinkedIn page, sometimes a website. Posted compensation: $200,000 to $300,000 USD per year in the lures documented by SANS.
2. The technical test
Before the interview, the recruiter sends a polite Google Doc with the project context + a link to a GitHub or Bitbucket repo. You're asked to clone, run, and submit a PR with your improvement ideas. The repo looks like a real React/Web3 project with hundreds of lines of MEV bot or crypto utility code.
3. Execution
At
npm install, or more subtly atnpm start, the malware fires. The payload is obfuscated (reversed Base64 + XOR, or Function.constructor to bypass static scanners). Vladimir Novick (a developer who documented a direct case on dev.to) counted up to 5 chained stages, with an editable Google Doc as C2 server to push updates without touching the GitHub repo.4. The theft
BeaverTail collects credentials from browsers (Chrome, Brave, Firefox), the macOS Keychain, and at least 12 crypto wallets including Solana. It then fetches InvisibleFerret as a second stage, which establishes a bidirectional C2 channel for remote tasking.
5. Persistence
The malware installs itself in autostart. In the Axios case, a macOS binary at /Library/Caches/com.apple.act.mond beacons to the C2 every 60 seconds. On Windows, a fake Windows Terminal at %PROGRAMDATA%\wt.exe. On Linux, a Python RAT at /tmp/ld.py launched via nohup.
Source
The repo was malware. It didn't get me, but it's something developers should be aware of. Every API key, AWS credential, GitHub/npm token in your shell environment gets stolen.
The malware zoo
Kir Boyenko (Socket) uses the term "malware zoo" to describe the stack in use. Three main families show up in 90% of documented cases, with variants depending on the victim's OS.
The 3 Contagious Interview malware families
| Family | Role | Main target | OS |
|---|---|---|---|
| BeaverTail | 1st stage stealer | Browsers, macOS Keychain, ≥12 crypto wallets, AWS/npm/GitHub tokens | Windows + macOS + Linux |
| InvisibleFerret | 2nd stage RAT | Remote tasking, bidirectional C2, continuous exfiltration, sometimes credit cards | Windows + macOS + Linux |
| OtterCookie | Stealer variant | Similar to BeaverTail, sometimes substituted depending on the campaign | Windows + macOS + Linux |
The loaders used to deliver these payloads are also named: HexEval (hex → ASCII encoding to hide the C2 URL), XORIndex (code chunks scrambled at runtime). They're used to separate the npm package's delivery from the actual payload, so that static analysis of the package (by a scanner or a human) reveals nothing.
The Axios case of March 31, 2026
Axios is not an obscure package. 100 million downloads per week. It's in the top 10 most-used npm packages.
The sequence as told by Snyk:
- 00:21 UTC: axios@1.14.1 published, with plain-crypto-js@4.2.1 as a new dependency.
- 00:27 UTC: Socket scanner detects the payload (6 minutes).
- 01:00 UTC: axios@0.30.4 published with the same malicious dependency.
- 03:29 UTC: both versions removed from npm.
Three-hour window. During that window, every npm install that touched axios downloaded a postinstall: node setup.js that decoded an obfuscated blob (reversed Base64 + XOR with key OrDeR_7077). The final payload is a cross-platform RAT that beacons to sfrclak[.]com:8000.
Exact attribution of the Axios case is not confirmed 100% as Lazarus, but the pattern (maintainer account takeover via social engineering, multi-stage dropper, cross-platform remote C2) fits the Contagious Interview TTPs. And the timing coincidence with the April 2026 Socket wave peak is suspicious.
What we do at clients with a JS stack
For SMBs and agencies shipping JavaScript in 2026, here's the list we apply.
Baseline anti-Contagious Interview hygiene
- `npm ci --ignore-scripts` in CI. Disables `postinstall`, the #1 Contagious Interview dropper vector.
- Exact-pin versions in package.json. No `^` or `~`. Lockfile in strict mode.
- Behavioral scanner on PRs. Socket or Snyk as a GitHub App, blocking suspicious packages before merge. Not just `npm audit`.
- 48-72h quarantine on new packages before promotion. Socket and Snyk support this natively.
- Dev onboarding: one-page doc explaining the fake recruiter trap. Juniors and freelancers are the priority targets.
- Absolute rule: no developer runs recruiter code on their work machine. Isolated VM, never with a wallet or mounted Keychain.
- Annual audit of the machines of devs who handle a crypto wallet or production client environment.
When to alert, when to isolate
Si
A developer mentions cloning a "recruiter" repo this week
Alors
Isolate their machine from the network, inventory installed packages, rotate credentials (npm, GitHub, AWS, crypto wallets).
Even if nothing appears to have happened. The payload may be dormant.
Si
You see an unknown package in package-lock.json after an automatic `npm install`
Alors
Roll back the lockfile, compare with the previous one, look up the package on socket.dev before authorizing.
Typo-squatted packages are one of the most common techniques.
Si
A maintainer of a popular package you use publishes a version without a clear changelog
Alors
Wait 48h, watch Socket and Snyk for signals, then update.
This is exactly the Axios pattern. Compromised packages are pulled fast but the window is fatal.
Questions we hear in agency
We're a marketing SMB, not a software vendor. Why does this concern us?
If your team or your agency uses Next.js, React, Vue, or any JS framework for client sites or internal tools, you install npm. Your freelance developer too. And if that dev gets caught, the stolen credentials may include access to your client accounts (GA4, Meta Business, Google Ads via stored OAuth tokens).
We use pnpm/yarn, are we protected?
No. The vector is the package itself, not the package manager. pnpm and yarn have stricter modes (pnpm has a configurable --ignore-scripts option by default), but malicious packages hiding their payload inside the library code (not in a postinstall) remain dangerous.
GitHub Copilot or Cursor sometimes recommend packages in their suggestions. Is that risky?
Yes, more than people think. LLMs sometimes hallucinate package names. North Korean attackers (and other groups) register these hallucinated names to trap devs who accept the suggestion without checking. Always look up the package on npmjs.com or socket.dev before installing it.
How long does it take to set up the bare minimum?
Activating Socket as a GitHub App on a repo takes an afternoon. Reviewing CI and adding --ignore-scripts takes another. The long part is culture: making your devs understand that the fake recruiter is a real attack specifically targeting them.
Verdict
The "supply chain" angle is interesting because it shifts the defense. You can't patch against Contagious Interview with a firewall or an antivirus. It's dev hygiene, team culture, and continuous CI tooling.
For an SMB without a dedicated security team: the bare minimum comes down to three actions. Activate Socket (or Snyk in behavioral mode) as a GitHub App on the repos that run JS. Write a one-page onboarding that describes the fake recruiter trap in very concrete terms. And audit once a year the machines of devs who handle a crypto wallet or production client environments. The rest comes with time.
Want a quick audit of your team's dev/marketing stack? We look at the supply chain risk in 1h, free for Quebec SMBs we haven't met yet.
Book the audit