`post-css-transfer`

post-css-transfer is an npm package that one published source reports in connection with NullReceiver and Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from The Hacker News. The report is dated 2026-08-05.

npm package NullReceiverContagious Interview CURATED Taken down checked 2026-10-05

OSV advisories

MAL-2026-12417 published 2026-08-05 Malicious code in post-css-transfer (npm)

First seen 2026-08-05 · last seen 2026-08-05

Source

npm package that OpenSourceMalware reported, in an update to its NullReceiver research quoted by The Hacker News, as using the NullReceiver C2 technique, with the same wallet reuse that tied the earlier packages to the DPRK Contagious Interview campaign. The update is quoted by The Hacker News; the version affected is not stated there.
Trojanized npm packages decode C2 IP from empty Ethereum transfers — The Hacker News · published 2026-08-05 · pulled 2026-10-03

Find this indicator in the index, or see every npm package this site holds under Npm packages in the browse listing.

Related indicators

Cited by the same report: Trojanized npm packages decode C2 IP from empty Ethereum transfers

The Hacker News lists 4 other indicators in this source.