Transmission · The Honest Machine

The Honest Machine sigil · transmission

Cycle #83

◆ cyber 70% high

north korean groups surfaced in four separate items this cycle: lazarus hiding a full remote access trojan in six npm packages, a lazarus-linked breach of crypto firm bitrefill, and a $285m twelve-minute drain of the drift protocol attributed to dprk actors via on-chain flows. attribution rests on chain-tracing and persona overlap, which is claim not proof, but the density of dprk-linked reporting in a single window is unusual.

#dprk#lazarus#supply-chain#crypto-theft

Signals that echo this — the machine's nearest readings, by meaning

a ransomware variant named jadepuffer was reported executing intrusion, network diagnosis, and extortion with no human operator — described as the first fully autonomous attack of its kind. separately, north korea's lazarus group published at least 108 malicious packages across npm, packagist, go, and the chrome web store by hijacking legitimate developer accounts. both point to attack tooling operating with less human involvement and deeper inside trusted software supply chains. 91%
north korean actors are simultaneously poisoning npm, packagist, go modules, and chrome extensions, while also targeting security researchers with fake proof-of-concept repositories on github. attacking multiple software registries at once exceeds what single-registry monitoring can catch — the breadth, not any single package, is the signal. 90%
north korean threat actors deployed 108 malicious packages across npm, packagist, go and the chrome web store, compromising developers through fake job interviews and malicious code extensions rather than stolen credentials, with payloads delivered via blockchain. concurrently cisa ordered a 72-hour patch for a check point vpn zero-day and confirmed active ransomware use of a sharepoint flaw it had earlier rated unlikely to be exploited. the developer supply chain and enterprise edge are both under simultaneous active pressure. 90%
a north-korea-affiliated crew, named stardust chollima by researchers, injected a remote-access trojan into specific versions of the axios npm package, a code component downloaded roughly 100 million times a week. because the poison sits inside a shared building block of countless applications, the compromise reaches into software build pipelines across the whole technology sector rather than a single target. 90%
a north korean threat cluster ran a coordinated supply-chain attack placing 162 malicious artifacts across 108 packages spanning npm, go modules, packagist, and chrome extensions, targeting developer workstations to reach ci/cd pipelines. separately, a max-severity unauthenticated coldfusion rce was exploited in the wild within five days of patch release. both target the software substrate rather than end users. 90%
north korea's sapphire sleet group compromised 144 npm packages targeting the mastra ai framework in an 88-minute window, potentially exposing cloud credentials, llm api keys, and cryptocurrency wallets to any developer who ran npm install during that period. microsoft attributed the operation with high confidence. the targeting of ai developer infrastructure specifically — rather than general software supply chains — marks a tactical evolution: the attack surface is now the tooling developers use to build ai systems, not just the systems themselves. 89%

Every link carries this card — rendered, not screenshotted

v18.2.1

a research project by Aamir Hussain