A hiring scheme aimed at crypto candidates can turn a routine coding test into an installation risk, with repository settings directing npm to an outside package source, OpenSourceMalware said.
In an Oct. 21 disclosure, the security platform described LinkedIn candidates receiving development tasks that require installing software packages from private repositories. OpenSourceMalware said a private repository can direct npm to a separate package registry. Installing a dependency from that registry may deliver the malicious payload. It also said the configuration can make a package resolve only for its intended target.
OpenSourceMalware linked the activity to North Korea and described it as part of Contagious Interview. The disclosure did not name affected companies, give a victim count for this activity or estimate digital asset losses.
A Sept. 18 joint government advisory identified the actor group WaterPlum, commonly referred to as Contagious Interview. It said an earlier phase compromised at least 30,000 devices in more than 100 countries from around December 2025 through July 2026.
The advisory said the campaign exploits routine hiring steps to reach job seekers and can expose credentials, sensitive information, cryptocurrency and organizations connected to victims.
