Malicious npm Packages Use Pastebin Steganography

Socket uncovered 26 malicious npm packages deploying a sophisticated nine-module infostealer toolkit attributed to North Korea’s FAMOUS CHOLLIMA group. The attack chain uses character-level steganography on Pastebin to hide C2 infrastructure, ultimately delivering a RAT and infostealer modules that go after developer credentials, SSH keys, cryptocurrency wallets, and Git repositories through typosquatted package installations. Researcher Kieran Miyamoto had flagged the first 17 packages a day earlier, finding that the pastes decode to 31 Vercel hostnames, of which only one was live and answered anything but curl with a decoy “Permanently suspended”. Hiding your C2 in every Nth letter of a Pastebin essay about computer science, because base64 was apparently too mainstream.