Lazarus Group Exploits Github, npm package Cryptocurrency Malware Campaign

Table of Contents

Following the analysis of the SecurityScorecard strike team, cyber groups lined up in the provinces from North Korea breached GitHub repository and NPM modules with stealth malicious code, stealing digital currency and stealing digital currency.

Security researchers warn of rising open source malware attacks linked to the Lazarus Group

As detailed in the Computing.co.uk report, Lazarus Group injects harmful JavaScript into its Github project under the pseudonym “Success Friend” but the NPM tool that blockchain engineers rely on destroyed. The codename “Marstech Mayhem Operation” exploits the weaknesses of the software supply chain to spread Marstech1 malware designed to penetrate wallets such as Metamask, Exodus, and atoms.

MARSTECH1 COMBS-infected devices for cryptocurrency wallets manipulate browser settings to secretly redirect transactions. By impersonating itself as a benign system activity, the code avoids security scans and allows for persistent data extraction. According to Computing.co.uk, this represents the second major GitHub-based violation in 2025, when attackers weaponized the platform’s scope to propagate malicious software in January 2025 reflects the incident.

The report further notes that SecurityScoreCard has identified 233 compromised entities across the US, Europe and Asia, confirming that Lazarus-related scripts are in operation since July 2024. A parallel strategy was introduced in January 2025. This came when a fake Python library disguised as a Deepseek AI utility was removed from Pypi to harvest developer logins.

Analysts warn that such invasions could proliferate significantly in 2025, and could be driven by a development pipeline intertwined with open source ubiquitousness. Computing.co.uk explains that the Security Week article refers to the recent classification of supply chain vulnerabilities as the best cybersecurity threat.

Lazarus’ latest efforts represent the sophisticated tactics of government-sponsored digital spy targeting critical technical frameworks. Computing.co.uk Note Global Entities recommend scrutinizing third-party code integrations and strengthening review mechanisms to combat these threats.