OpenSourceMalware Flags Private Repositories in Crypto Hiring

OpenSourceMalware described a crypto hiring campaign that sends LinkedIn candidates to private code repositories, where package settings may run malicious code during installation, in an Oct. 21 disclosure. The security platform characterized the activity as North Korea-linked and part of Contagious Interview.

Candidates receive a development task that requires installing software packages. A .npmrc file in the repository directs npm to fetch dependencies from a specified external package registry instead of the public registry. That setup may run malicious code during installation and make the activity less likely to appear in public security scans.

Attackers have recently used the technique. The disclosure provided no victim count, affected company names or estimate of digital asset losses.

An earlier phase of the campaign compromised 30,000 or more devices across 100-plus countries from about December 2025 through July 2026.