`nrwise@proton.me`

nrwise@proton.me is an email address that 6 published sources report in connection with IT Worker Fraud and Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from Kudelski Security Research, Elastic Security Labs, N3mes1s, Hunt.io, DCSO and IGLOO Security. The earliest of those reports is dated 2026-03-31 and the most recent 2026-10-18.

email address IT Worker Fraud Contagious Interview MATCHED IN SOURCE

First seen 2026-03-31 · last seen 2026-10-18

Sources

…· compromised legitimate axios maintainer, email changed to ifstap@proton.me[email protected] nrwise · attacker-created account, nrwise@proton.me[email protected] , published plain-crypto-js Assesing wheter your npm system is affected The Safe Version Reference is:…
Kudelski Security Research — Kudelski Security Research · under “Indicators of Compromise” · published 2025-03-05 · pulled 2026-09-10
…UTC — axios@1.14.0 published legitimately via GitHub Actions OIDC 2026-03-30 05:57 UTC — plain-crypto-js@4.2.0 published by nrwise ( nrwise@proton.me ) — clean decoy to build registry history 2026-03-30 23:59 UTC — plain-crypto-js@4.2.1 published by nrwise — malicious version with…
Inside the Axios supply chain compromise - one RAT to rule them all — Elastic Security Labs · under “Timeline” · published 2026-04-01 · pulled 2026-09-12
…" }, { "platform" : " npm " , "username" : " nrwise " , "email" : " nrwise@proton.me " , "type" : " created_by_attacker " , "status" : " suspended " } ],…
Axios npm Supply Chain Compromise (2026-03-31) — Full RE + Dynamic Analysis + BlueNoroff Attribution — N3mes1s · under “Platform-Specific Fingerprint Fields” · published 2026-03-31 · pulled 2026-09-12
…chain takes under two seconds. Timeline Event T-18 hours Attacker publishes clean decoy plain-crypto-js@4.2.0 from account nrwise@proton.me T-0 Malicious plain-crypto-js@4.2.1 published with postinstall hook containing obfuscated dropper T+0 Compromised axios@1.14.1 and…
Breaking Down the Axios Supply Chain Attack: Dropper, Cross-Platform RATs, and BlueNoroff/TA444 — Hunt.io · under “Attack Timeline” · published 2026-04-01 · pulled 2026-09-12
Nearby text:

…and Huntress : 142.11.206.73 23.254.167.216 http://sfrclak.com http://sfrclak.com:8000 http://sfrclak.com:8000/6202033 ifstap@proton.me nrwise@proton.me Email Addresses The email addresses that have been used to push the malicious package utilized proton.me as an email provider.…
From Axios NPM Supply Chain Attack to Tracking DPRK’s BlueNoroff — DCSO · under “Analyzing publicly reported BlueNoroff Infrastructure” · published 2026-04-02 · pulled 2026-09-12
…주요 공격 내용 상세 공격현황 2026-03-30 05:57 사전 포석용 패키지 배포 ( v4.2.0 ) • 악성코드가 없는 클린한 버전의 plain-crypto-js 배포( nrwise@proton.me ) • 정상적인 crypto-js 복사본으로, 악성 코드나 postinstall 훅이 없는 정상코드만 포함 • 신규 계정에 대한 보안 스캐너의 의심을 피하기 위한 '정상 이력(History)' 생성 목적으로 사용…
Supply Chain Attack on Axios NPM Package via North Korean Threat Actors — IGLOO Security · under “2.3. Attack Timeline” · published 2026-04-17 · pulled 2026-09-12
…Issue #10590 deleted." }, { "platform": "npm", "username": "nrwise", "email": "nrwise@proton.me", "type": "created_by_attacker", "status": "suspended" } ],…
Axios npm Supply Chain Compromise (2026-03-31) — Full RE + Dynamic Analysis + BlueNoroff Attribution — N3mes1s · under “Platform-Specific Fingerprint Fields” · published 2026-03-31 · pulled 2026-09-14
…Accounts : jasonsaayman · compromised legitimate axios maintainer, email changed to ifstap@proton.me nrwise · attacker-created account, nrwise@proton.me, published plain-crypto-js Assesing wheter your npm system is affected The Safe Version Reference is: axios@1.14.0 (safe) · shasum:…
Kudelski Security Research — Kudelski Security Research · under “Indicators of Compromise” · published 2025-03-05 · pulled 2026-10-01

Find this indicator in the index, or see every email address this site holds under Email addresses in the browse listing.

Related indicators

Cited by the same report: Kudelski Security Research

Kudelski Security Research lists 66 other indicators in this source. 5 are shown, chosen across types.

All 67 indicators from this source

Cited by the same report: Inside the Axios supply chain compromise - one RAT to rule them all

Elastic Security Labs lists 2 other indicators in this source.

Cited by the same report: Axios npm Supply Chain Compromise (2026-03-31) — Full RE + Dynamic Analysis + BlueNoroff Attribution

N3mes1s lists 47 other indicators in this source. 5 are shown, chosen across types.

All 48 indicators from this source