Socket Research has identified a North Korean APT (Famous Chollima) supply chain attack targeting PHP developers via a compromised dev branch of the legitimate Packagist package roberts/leads. Malicious obfuscated JavaScript was injected into tailwind.js in the dev-drewroberts/feature/test-case branch. The loader uses blockchain infrastructure (TRON, Aptos, BNB Smart Chain) as a dead-drop C2 mechanism to retrieve, decrypt via XOR, and execute remote payloads using eval() and hidden Node.js child processes. The attack pattern matches Contagious Interview-style lures where victims are socially engineered — typically through fake job interviews — into installing a specific dev branch. Prior campaigns using the same infrastructure delivered DEV#POPPER RAT, OmniStealer, and BeaverTail payloads. Developers are advised to inspect build config files before running unfamiliar projects, avoid untrusted dev branches, and restrict CI secret scopes.
Table of contents
The Malicious tailwind.js #Deobfuscation Findings #Loader Behavior #Exfiltration and Final Payload Scope #Why This Looks Targeted #Recommendations and Mitigations #Indicators of Compromise #MITRE ATT&CK #238 Impressions1 Comment