sjs-builder
sjs-builder is an npm package
that one published source reports
in connection with Contagious Interview activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Panther Labs.
The report is dated 2026-04-10.
npm package Contagious Interview CURATED Taken down
OSV advisories
Source
-
Malicious npm package identified in an April 2026 OtterCookie infostealer campaign tracked by Panther, using a two-layer distribution strategy: a benign wrapper package pulls in this obfuscated payload package one dependency layer deep. On install, a postinstall hook triggers a loader that imports and executes the OtterCookie exfiltration/persistence logic. OtterCookie is the third malware family, alongside BeaverTail and InvisibleFerret, delivered through the Contagious Interview npm supply chain.
Tracking an OtterCookie Infostealer Campaign Across npm — Panther Labs
Find this indicator in the index, or see every npm package this site holds under Npm packages in the browse listing.