North Korean Hackers Target Developer Credentials to Poison GitHub Repositories and Software…

Software development environments have become an increasingly attractive target for sophisticated cybercriminal groups. A compromised developer account can provide attackers with access to source code, software repositories, package publishing systems, and trusted distribution channels.

A reported campaign involving North Korean-linked threat actors highlights this growing risk. By stealing developer credentials and abusing legitimate development platforms such as GitHub, attackers can attempt to introduce malicious code into software projects and distribute it through trusted package ecosystems.

This approach is particularly concerning because malicious changes introduced through legitimate development accounts can be difficult to distinguish from normal software updates.

From Fake Job Interviews to Software Supply Chain Attacks

According to ESET researchers, the North Korean-linked group, tracked as DeceptiveDevelopment, expanded its operations between April and September 2026.

Previously, the group primarily used fake recruitment offers and technical assessment exercises to trick developers into downloading and running malicious projects. Once executed, the malware searched infected systems for Git credentials, SSH keys, and access tokens.

The attackers then used the stolen credentials to access developers' accounts and modify repositories. In some cases, they reportedly rewrote Git commit histories to make unauthorized changes more difficult to identify during routine reviews.

ESET identified compromised projects and malicious files across several software distribution platforms, including:

• npm, the JavaScript package registry
• PyPI, the Python package repository
• Packagist, used by PHP developers
• Go module distribution infrastructure
• Browser extension marketplaces

Many affected projects were smaller tools maintained by individual developers. Compromising these projects gave attackers an opportunity to reach downstream users who trusted and installed the software.

Malware Used to Steal Credentials and Maintain Access

ESET identified two notable malware families associated with the campaign.

1. OmniStealer

OmniStealer is a Python-based information stealer designed to collect sensitive information from compromised devices. Its targets include:

• Browser credentials and saved login information
• Cryptocurrency wallet data
• Password manager information
• Developer credentials, tokens, and secrets

2. DEV#POPPER

DEV#POPPER is a Node.js-based remote access trojan that provides attackers with additional control over infected systems.

Researchers observed newer versions inserting malicious code into applications commonly used by developers, including Visual Studio Code, Cursor, and Discord. This approach can help the malware execute again when users launch these applications.

The combination of information theft and remote access creates a serious risk for organizations because compromised developer workstations may contain access to source code, cloud environments, deployment systems, and production infrastructure.

Blockchain Technology Used to Hide Command Infrastructure

One of the more unusual aspects of this campaign is the use of blockchain transactions to make attacker infrastructure more difficult to disrupt.

ESET identified a technique referred to as NullReceiver. Rather than relying on a fixed command-and-control server address embedded in the malware, the malicious loader checks an Ethereum transaction associated with a predefined wallet address.

It then extracts the destination IP address from the transaction's recipient field and uses that information to contact the attacker's infrastructure.

This gives attackers the ability to change their command server by updating blockchain transaction information, without having to publish a new version of the compromised package.

Researchers also found blockchain-based server lookup functionality inside a weaponized GitHub repository that used a hidden Visual Studio Code task.

The campaign additionally used services such as Gitea, JSONBin.io, JSONHosting, and Pinata's IPFS gateway to host or distribute malicious content. These services can make investigation and takedown efforts more complicated.

Why This Campaign Is a Serious Supply Chain Risk

The most concerning aspect is the potential reach of a compromised developer account.

A single developer workstation may hold credentials for multiple repositories, package registries, cloud accounts, and automated deployment environments. If attackers gain access to these privileges, they may be able to compromise more than the original device.

The consequences can extend to:

• Software companies: Unauthorized changes to source code and release pipelines can undermine product integrity.
• Financial services: Compromised development environments may expose sensitive application code, cloud credentials, and financial technology systems.
• Healthcare: Malicious software updates can create risks for systems that process patient information and support healthcare operations.
• Retail and e-commerce: Compromised packages can affect payment applications, customer-facing services, and connected business platforms.
• Manufacturing: Software supply chain compromise can introduce risks to industrial applications and supporting infrastructure.
• Government organizations: Trusted software dependencies and developer accounts can become potential entry points into sensitive environments.

Security Measures Organizations Should Prioritize

Organizations should treat developer accounts and software publishing privileges as critical assets. The following measures can help reduce exposure:

1. Secure developer credentials

Use phishing-resistant multifactor authentication wherever possible. Store access tokens securely, restrict their permissions, and establish short expiration periods. Avoid using long-lived personal access tokens when safer alternatives are available.

2. Review repository activity

Monitor unexpected commits, unfamiliar branches, changes to workflow files, unusual releases, and rewritten Git histories. Require independent review for sensitive code changes.

3. Strengthen CI/CD pipeline security

Restrict workflow permissions, isolate build environments, protect deployment secrets, and require approvals before production releases. Use short-lived credentials and avoid exposing secrets to untrusted pull requests.

4. Verify software dependencies

Use software composition analysis, dependency scanning, package integrity verification, and trusted lockfiles. Review newly introduced dependencies and unexpected package version changes before deployment.

5. Protect developer workstations

Apply endpoint detection and response, restrict unauthorized script execution, maintain secure development configurations, and monitor unusual activity involving developer tools and applications.

6. Monitor for suspicious network activity

Investigate unexpected outbound connections from developer devices and build systems, including unusual blockchain-related traffic. Correlate endpoint, identity, repository, and network telemetry.

7. Establish a credential rotation and recovery process

If a developer environment is suspected of compromise, revoke affected sessions and tokens, rotate SSH keys and package publishing credentials, review repository permissions, and investigate possible downstream exposure. Perform these actions from a trusted environment.

8. Maintain a software supply chain security program

Keep an inventory of software dependencies, maintain clear ownership of repositories, establish vendor security requirements, and regularly test the security of development and release processes.

Conclusion

The DeceptiveDevelopment campaign highlights how cybercriminals are evolving from targeting individual developers to compromising the software ecosystems they help maintain.

Stolen developer credentials can provide attackers with access to trusted repositories and package publishing channels. By injecting malicious code into legitimate projects, they can potentially turn one compromised account into a wider supply chain security incident.

Organizations must therefore protect the entire software development lifecycle, from developer workstations and source code repositories to dependency management, CI/CD pipelines, and production deployments.

Strong identity security, continuous monitoring, secure coding practices, dependency validation, and regular security assessments are essential to reducing this risk.

Software supply chain security is no longer just a development responsibility. It is a business-wide cybersecurity priority.

About COE Security

COE Security partners with organizations in financial services, healthcare, retail, manufacturing, and government to secure AI-powered systems and ensure compliance.

Our offerings include:

• AI-enhanced threat detection and real-time monitorin
• Data governance aligned with GDPR, HIPAA, and PCI DSS
• Secure model validation to guard against adversarial attacks
• Customized training to embed AI security best practices
• Penetration Testing (Mobile, Web, AI, Product, IoT, Network & Cloud)
• Secure Software Development Consulting (SSDLC)
• Customized CyberSecurity Services

COE Security can help organizations strengthen application and product security, assess development environments, identify vulnerabilities in software supply chains, evaluate cloud and network security, and improve security practices across the software development lifecycle.

Follow COE Security on LinkedIn for ongoing cybersecurity insights, emerging threat intelligence, and practical guidance to help your organization stay secure and cyber safe.