Malware Hidden in npm: How 'Contagious Interview' Targets Developer Wallets

A North Korea-linked campaign exploits developer trust in npm by hiding credential-stealing malware in postinstall scripts—code that executes automatically during npm install before developers inspect the application. By shifting the attack from readable source code to build-time automation, developers miss red flags they would otherwise catch. This supply chain vulnerability demonstrates why developers must scrutinize dependency management workflows, not just application code.