North Korean Hackers Target Node.js Maintainers in Sophisticated Social Engineering Campaign
A North Korean hacking group, identified as UNC1069, has been targeting high-profile maintainers of Node.js through a sophisticated social engineering campaign. The attack, which follows a similar pattern to the recent Axios supply chain attack, involves tricking maintainers into installing malware on their systems. The hackers initially engage their targets by inviting them to a Slack workspace and scheduling meetings on Microsoft Teams. During these meetings, the maintainers receive error messages and are instructed to install a fake update, which infects their systems with a Remote Access Trojan (RAT). This campaign has targeted several prominent figures in the Node.js community, including Socket CEO Feross Aboukhadijeh and members of the Node Package Maintenance Working Group. The attackers have been meticulous in their approach, building trust over weeks and using professional conduct to disguise their malicious intent. 
