DeceptiveDevelopment poisons repos after stealing developer credentials
Original title: North Korean Hackers Steal Developer Credentials to Inject Malware Into GitHub and Software Packages
ESET says the group planted code on npm, PyPI, Packagist, Go modules, and extension stores from April to September 2026.
ESET’s APT Activity Report says North Korea-aligned DeceptiveDevelopment shifted from fake hiring tasks to stealing Git credentials, SSH keys, and tokens, then adding malware to victims’ public and private repositories between April and September 2026. Poisoned projects appeared on npm, the Go module mirror, Packagist, PyPI, and browser extension marketplaces, mostly small single-maintainer tools. End-stage tools are OmniStealer and the Node.js RAT DEV#POPPER, which persists in VS Code, Cursor, and Discord. Some loaders resolve command servers from Ethereum transactions via a method called NullReceiver.
Unconfirmed: ESET infers the package spread was automatic rather than carefully chosen.
- Attackers often rewrite commit history after changing repositories.
- NullReceiver reads a server IP from an empty Ethereum transfer’s recipient.
- ESET says this is the first blockchain lookup built into a GitHub-hosted project it tracked.
- Later payloads were stored on JSONBin.io, JSONHosting, and Pinata’s IPFS gateway.
Impact: Stolen developer secrets and malware in trusted packages
- 1.Do not run recruiter-supplied code on a primary work machine.
- 2.Rotate Git tokens, SSH keys, and package publishing keys after suspected infection.
- 3.Review recent commits for rewritten history and unexpected blockchain traffic from builds.
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1078 Valid AccountsT1552.004 Private KeysT1059.007 JavaScript
- Threat actors
- DeceptiveDevelopment
- Malware
- OmniStealerDEV#POPPER
- Organizations
- ESET
- Countries
- North Korea
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | jsonbin.io | ntral team to report them to. Later payloads were stored on JSONBin.io, JSONHosting, and Pinata, a gateway to the IPFS network. On |
From the original article
4 min read at cybersecuritynews.com
A North Korea-aligned hacking group has moved beyond fake job interviews and now steals developer credentials to plant malware in trusted software projects. The group, tracked as DeceptiveDevelopment, used the stolen access to change code in public and private repositories between April and September 2026. Every poisoned project then became a new way into the […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.