Contagious Trader in npm: what trust gaps are teams missing?

TL;DR: North Korean threat actors used malicious npm packages, GitHub repos, and social promotion to target crypto developers, with more than 50 packages across 100 repositories and 20-plus command-and-control domains, according to Panther’s analysis. The campaign shows how software supply chain trust, repository identity, and sub-dependency execution can outpace standard scanner coverage and review workflows.

NHIMG editorial — based on content published by Panther covering the Contagious Trader npm supply chain campaign: Mapping The Contagious Trader Delivery Network

By the numbers:

• Panther identified over 50 malicious packages embedded across more than 100 GitHub repositories targeting developers in crypto ecosystems.
• The campaign operates across 20+ command-and-control domains at time of writing.
• Activity escalated in April, with 23 new packages published, more than double March’s output.

Questions worth separating out

Q: What breaks when malicious npm packages are allowed to run on developer endpoints?

A: They can turn install-time trust into code execution, then harvest browser-stored secrets, cloud tokens, and local credentials before defenders detect the compromise.

Q: Why do spoofed developer identities make supply chain attacks harder to detect?

A: Spoofed identities corrupt the trust signals teams often use to approve packages, such as contributor history, usernames, stars, and repository metadata.

Q: How can security teams tell whether package trust is being abused in their environment?

A: Look for unusual repository creation patterns, sudden publisher changes, transitive dependencies from unfamiliar accounts, and CI activity that reaches out to new domains.

Practitioner guidance

• Harden package intake controls Block direct installation of unreviewed npm packages in build systems, and require dependency allowlisting for repositories that can reach production secrets.
• Verify publisher provenance before trust decisions Check package ownership history, commit lineage, and repository creation patterns before approving code for internal use.
• Scan for secret exposure in developer workflows Continuously monitor source control, CI/CD jobs, and developer machines for leaked environment secrets, SSH keys, and API tokens.

What's in the full report

Panther's full report covers the operational detail this post intentionally leaves for the source:

• Per-family package listings and IoCs for PromptMink, ClipViper, and OtterCookie across the observed repositories.
• Campaign timeline detail showing how package volume changed from February through May 2026.
• Repository-level examples of identity spoofing, fork chains, and dependency insertion patterns.
• Cross-referenced intelligence and campaign attribution details that support analyst validation and response planning.

👉 Read Panther's analysis of the Contagious Trader npm supply chain campaign →

Contagious Trader in npm: what trust gaps are teams missing?

Explore further

View Full Forum →  |  NHI Foundation Course →