Contagious Interview Campaign: 338 Malicious npm Packages Target Crypto Developers

State-sponsored threat actors have escalated the Contagious Interview campaign, deploying 338 malicious npm packages to target cryptocurrency and blockchain developers. The operation uses sophisticated social engineering tactics, including fake personas and job offers, to deliver advanced malware like BeaverTail and InvisibleFerret backdoors. Researchers have identified this as a factory-style operation designed to compromise developer endpoints and steal cryptocurrency assets. The campaign follows the Lockheed Martin Cyber Kill Chain framework, beginning with reconnaissance on LinkedIn and culminating in the installation of malicious dependencies. The threat actors have evolved their techniques, moving beyond simple malware droppers to implement three distinct loader families. The campaign's persistence and scale highlight the challenges facing the npm ecosystem and the broader software supply chain.