Chollima Hunter

← Remote Workers

preset-log

preset-log is an npm package that 2 published sources report in connection with Contagious Interview and IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from Socket and GitLab Threat Intelligence. The earliest of those reports is dated 2025-10-10 and the most recent 2026-02-19.

npm package Contagious InterviewIT Worker Fraud CURATED Taken down checked 2026-10-01

OSV advisories

  • MAL-2025-5791 published 2025-07-10 Malicious code in preset-log (npm)

First seen 2025-10-10 · last seen 2026-02-19

Sources

  • One of 338 malicious npm packages Socket identified between July and October 2025 in the Contagious Interview campaign. Typosquats of common developer tooling whose install or import hook runs a HexEval, XORIndex or encrypted loader that reconstructs BeaverTail in memory and typically fetches InvisibleFerret.
    North Korea's Contagious Interview Campaign Escalates: 338 Malicious npm Packages, 50,000 Downloads — Socket · published 2025-10-10 · pulled 2026-09-21
  • …malware Year in Review dotenv-intend npm package malware N/A N/A Malicious NPM dependency used to deliver malware Year in Review preset-log npm package malware N/A N/A Malicious NPM dependency used to deliver malware Year in Review 111.197.183.74 ipv4 insider October 2025 October 2025…
    GitLab Threat Intelligence Team reveals North Korean tradecraft — GitLab Threat Intelligence · under “Appendix 2: Indicators of Compromise” · published 2026-02-19 · pulled 2026-10-02

Find this indicator in the index, or see every npm package this site holds under Npm packages in the browse listing.

Related indicators

Cited by the same report: North Korea's Contagious Interview Campaign Escalates: 338 Malicious npm Packages, 50,000 Downloads

Socket lists 563 other indicators in this source. 7 are shown, chosen across types.

All 564 indicators from this source

Cited by the same report: GitLab Threat Intelligence Team reveals North Korean tradecraft

GitLab Threat Intelligence lists 733 other indicators in this source. 5 are shown, chosen across types.

All 734 indicators from this source

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. See the sourcing methodology.