`https://jsonkeeper.com/b/4NAKK`

https://jsonkeeper.com/b/4NAKK is a payload URL that 2 published sources report in connection with IT Worker Fraud, Contagious Interview and unclustered DPRK activity, which public reporting attributes to North Korea (DPRK). It is cited here from GitLab Threat Intelligence and SafeDep. The earliest of those reports is dated 2026-02-19 and the most recent 2026-07-09.

payload url IT Worker Fraud Contagious InterviewDPRK (cluster unattributed) MATCHED IN SOURCE

First seen 2026-02-19 · last seen 2026-07-09

Sources

Nearby text:

…https://ip-check-server.vercel.app/api/ip-check-encrypted/3aeb34a37 url malware N/A N/A JavaScript malware dropper URL Year in Review https://jsonkeeper.com/b/4NAKK url malware N/A N/A JavaScript malware dropper URL Year in Review https://jsonkeeper.com/b/8RLOV url malware N/A N/A JavaScript malware…
GitLab Threat Intelligence Team reveals North Korean tradecraft — GitLab Threat Intelligence · under “Appendix 2: Indicators of Compromise” · published 2026-02-19 · pulled 2026-10-02
…same shape as the block in caller.js , but its base64 points at a second dead drop. 1 aHR0cHM6Ly9qc29ua2VlcGVyLmNvbS9iLzROQUtL => https://jsonkeeper.com/b/4NAKK https://jsonkeeper.com/b/4NAKK"> SafeDep’s analysis records that this backdoor is byte identical to an earlier package,…
nodemon-sudo: an npm Backdoor With No Install Script - Real-time Open Source Software Supply Chain Security — SafeDep · under “The dead drops tie the campaign together” · published 2026-07-09 · pulled 2026-10-12
…the same shape as the block in caller.js , but its base64 points at a second dead drop. aHR0cHM6Ly9qc29ua2VlcGVyLmNvbS9iLzROQUtL => https://jsonkeeper.com/b/4NAKK SafeDep’s analysis records that this backdoor is byte identical to an earlier package, nodemon-node , that used the same Pinata CID and…
nodemon-sudo: an npm Backdoor With No Install Script - Real-time Open Source Software Supply Chain Security — SafeDep · under “The dead drops tie the campaign together” · published 2026-07-09 · pulled 2026-11-13

Find this indicator in the index, or see every payload URL this site holds under Payload URLs in the browse listing.

Related indicators

Cited by the same report: GitLab Threat Intelligence Team reveals North Korean tradecraft

GitLab Threat Intelligence lists 733 other indicators in this source. 7 are shown, chosen across types.

All 734 indicators from this source

Cited by the same report: nodemon-sudo: an npm Backdoor With No Install Script - Real-time Open Source Software Supply Chain Security

SafeDep lists 2 other indicators in this source.