North Korean Actors Deploy Malicious NPM Packages to Steal Git Repositories

The Lazarus Group, North Korea's most prolific threat actor, launched a new campaign called SnugBit targeting software developers across multiple platforms through malicious NPM packages. Attackers published dozens of seemingly legitimate NPM packages using typosquatting names. Once installed, packages collect environment variables, SSH keys, Git credentials and .env files, sending everything to attacker-controlled servers. Developers are high-value targets due to access to source code, CI/CD pipelines, cloud credentials and client secrets. Protect yourself by verifying package reputation, using lock files, implementing dependency security scanning, and never storing credentials in plain environment variables.