Malicious npm Packages Deliver PylangGhost RAT in New Software Supply Chain Campaign

A remote access trojan known as PylangGhost has appeared on the npm registry for the first time, concealed inside two malicious JavaScript packages.

The malware, first publicly disclosed by Cisco Talos in June 2025 and attributed to the North Korean state-sponsored threat group FAMOUS CHOLLIMA, marks a significant escalation in software supply chain attacks targeting developers around the world.​

PylangGhost has been tracked for months as part of coordinated campaigns tied to North Korean cyber operations.

FAMOUS CHOLLIMA is well known in the security community for targeting software developers through trojanized code repositories, fabricated job opportunities, and social engineering tactics designed to gain unauthorized system access.

The group’s deliberate move onto npm — one of the most widely used open-source package registries in the world — signals a calculated effort to compromise development pipelines at a much larger scale than previously observed.​

Kmsec.uk researchers identified two malicious packages published by user jaime9008, linked to the email jaimeandujo086[@]gmail.com.

The first package, @jaime9008/math-service, was uploaded in late February 2026, and the second, react-refresh-update, surfaced in early March 2026.

Both packages cycled rapidly through multiple version updates, with the PylangGhost loader embedded inside key JavaScript files including runtime.js, babel.js, and lib/lib.js.​

The campaign identifier hardcoded into the malware is “ML2J,” and the attacker’s command-and-control (C2) infrastructure relies on the domain malicanbur[.]pro, with a C2 IP address of 173.211.46[.]22:8080.

This marks the first confirmed instance of PylangGhost appearing on npm and reflects the speed at which FAMOUS CHOLLIMA continues to develop and deploy new tools.

Any developer who installed either of these packages during the active window may have had their system silently compromised without any visible indication.​

The broader danger of this campaign extends well beyond individual developers. Since npm packages are routinely pulled into large-scale projects, automated build systems, and CI/CD pipelines, a single infected dependency can quietly expose entire organizations.

The deceptive use of a convincing package name like react-refresh-update makes the threat much harder to catch through routine dependency reviews, giving the malware additional time to execute without raising suspicion.​

How the Infection Unfolds

The infection chain behind this campaign is carefully structured to execute silently across Windows, macOS, and Linux systems without triggering any immediate security alerts.​

Once a developer installs an affected package, a JavaScript loader embedded in specific files runs automatically.

This loader follows a decode-decrypt-evaluate sequence and uses a hardcoded XOR key — the string “fdfdfdfdf3rykyjjgfkwi” — to unlock the hidden payload before it executes in memory.​

After decryption, the loader checks the victim’s operating system and adjusts its behavior accordingly.

On Windows machines, it downloads a ZIP archive from malicanbur[.]pro in 10 MB increments — a method deliberately chosen to bypass network monitoring tools that flag large single-file transfers.

Once the download completes, the archive is extracted to the system’s temp directory and a VBScript file named start.vbs is silently launched through wscript, keeping the entire process invisible to the user.

On macOS and Linux target machines, a shell script is fetched directly and made executable before being run.​

The Windows payload has been uploaded to VirusTotal with the hash 0be2375362227f846c56c4de2db4d3113e197f0c605c297a7e0e0c154e94464e.

The C2 address is stored inside config.py within the archive’s root folder. The RAT is also capable of enumerating Chrome extension IDs installed on the compromised machine, giving attackers a direct path to browser-stored credentials and sensitive personal data.​

Developers and security teams should immediately audit their npm dependency trees for react-refresh-update and @jaime9008/math-service and remove both packages if found.

All network traffic to malicanbur[.]pro and 173.211.46[.]22:8080 should be blocked at the perimeter. Integrating software composition analysis tools into build and deployment pipelines helps catch compromised packages before they reach production.

Any unexpected network connections made during package installation should be treated as a serious incident and investigated promptly and thoroughly.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.