`https://api.npoint.io/9d94ec6053e75dbd933e`

https://api.npoint.io/9d94ec6053e75dbd933e is a payload URL that one published source reports in connection with Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from OpenSourceMalware. The report is dated 2026-01-20.

payload url Contagious Interview MATCHED IN SOURCE

First seen 2026-01-20 · last seen 2026-01-20

Source

…threat actors intended this library to get imported and their payload executed that way. The index.js file used curl to pull data from https://api.npoint.io/9d94ec6053e75dbd933e which was a heavily obfuscated JavaScript file.…
A Comprehensive Analysis of DPRK's Contagious Interview — OpenSourceMalware · under “Technical Analysis: JavaScript Obfuscation and the Main Payload” · published 2026-01-20 · pulled 2026-10-18

Find this indicator in the index, or see every payload URL this site holds under Payload URLs in the browse listing.

Related indicators

Cited by the same report: A Comprehensive Analysis of DPRK's Contagious Interview

OpenSourceMalware lists 5 other indicators in this source.