fake recruitercampaign: graphalgo
Graphalgo fake crypto developer recruitment campaign
Summary
EcosystemnpmPyPI
First discovered
Last activity
Still live
A Lazarus Group campaign that lures developers with fake cryptocurrency-recruiter pitches, then delivers 192 malicious npm and PyPI packages impersonating graph-algorithm and big-number math libraries. The malware fires the moment the library is imported, staging a multi-step downloader that pulls a remote-access trojan from attacker-controlled infrastructure.
Patient zero
First flagged graphalgo
Version: 2.2.5-preMost downloaded
graphbase-js82.3k
Top of 39 affected packagesMalicious versions published per day
134 versions across 39 packagesStay secure with our tools
Flagged packages in this campaign
Versions tagged to Graphalgo fake crypto developer recruitment campaignPackage version
Repo status
Published
Package downloads