APIThreat Intel Feed API · Confirmed malicious packages, campaigns and IOCs, piped into your stackExplore the API

Contagious Interview

discovered 2026-04-15

DPRK-linked (Famous Chollima) supply chain campaign targeting developers via npm, PyPI, and fake job interviews. MicrosoftSystem64 / js-logger-pack is attributed to this campaign cluster via the toskypi identity (tosky.pi1016@gmail.com), jpeek account rotation (jpeek868/886/895), and shared Lordplay/system-releases HuggingFace infrastructure. Overlapping sub-campaigns: Contagious Trader (crypto trading lures), BigSquatRat (typosquats).

Objective

Cryptocurrency theft, developer credential harvesting, persistent remote access to developer workstations

Packages

npmjs-logger-packattributed-to
npmterminal-logger-utilsattributed-to
npmts-logger-packattributed-to
npmpretty-logger-utilsattributed-to
npmpinno-loggersattributed-to
npmpolymarket-validatorattributed-to
npmchangelog-logger-utilitiesattributed-to

Indicators

domainapi-sub.jrodacooker.devcommunicates-with
domainhuggingface.cocommunicates-with
ipv4195.201.194.107communicates-with
sha256a49eee6b6db9da14db46587b68bf1d8a80976812f629bf3e100ac6ba83cf8490indicates
sha2566ce3b22b07fd5aef1dd77237334d80718601e4e02a706485572d3dda8993a4e3indicates
sha256571533a643e67c38087f4da8cce0d3dc14670a52403717e4943433d392860a7findicates
sha256585c5ab1fea06bed4956e34ffd6d6b576122addd34d252b163ae0801098e9eafindicates
sha2569f0a7174f9537bdbf63fe2329cea9a14198076180390af9f43a0e5b5c7c46912indicates
sha256e35801137cd09fa02aa996145d18ec68d67d71db9810f2608a6285ee1c08b054indicates
sha256df45bbac7695f0edad3edde36904f2722f2af761887744a2f1d65df705d28dc6indicates
sha25643c93c609d48b6cb4f1275c285b5e6960ef74e7f5811b442e3c1038d49128d73indicates
domaincopilot-ai.whisdev.orgcommunicates-with
sha256b2954c945b51dbd6fa88ac72338b7fbf76dec7d9909ceada9d36b21330842c97drops
urlhttps://huggingface.co/jpeek998/system-releases/resolve/maincommunicates-with
urlhttps://huggingface.co/Lordplay/system-releasescommunicates-with
emailjpeek868@gmail.comindicates
file path~/.local/share/MicrosoftSystem64uses
file path~/.pcl-state/uploads.jsonuses
emailtosky.pi1016@gmail.comindicates
urlhttps://huggingface.co/jpeek998/linux_doc_75a5ffec36caexfiltrates-to
domainsha256-validate-rpc.vercel.appexfiltrates-to
domainchangelog.restexfiltrates-to

Techniques

ttpT1195.001 Compromise Software Dependencies and Development Toolsuses
ttpT1059.007 JavaScriptuses
ttpT1552.001 Credentials In Filesuses
ttpT1041 Exfiltration Over C2 Channeluses
ttpT1552.004 Unsecured Credentials: Private Keysuses
ttpT1539 Steal Web Session Cookieuses
ttpT1105 Ingress Tool Transferuses
ttpT1071.001 Web Protocolsuses
ttpT1102 Web Serviceuses
ttpT1546 Event Triggered Executionuses
ttpT1195.002 Compromise Software Supply Chainuses
ttpT1555.003 Credentials from Password Stores: Web Browsersuses
ttpT1056.001 Input Capture: Keylogginguses
ttpT1115 Clipboard Datauses
ttpT1113 Screen Captureuses
ttpT1567.001 Exfiltration to Code Repositoryuses
ttpT1053.005 Scheduled Task/Job: Scheduled Taskuses
ttpT1543.004 Create or Modify System Process: Launch Daemonuses
ttpT1543.002 Systemd Serviceuses
ttpT1059.004 Unix Shelluses
ttpNode.js Single Executable Application Packaginguses
ttpT1027.013 Obfuscated Files or Information: Encrypted/Encoded Fileuses
ttpT1078.001 Valid Accounts: Default Accountsuses

Read the full analysis

APIThreat Intel Feed API · Confirmed malicious packages, campaigns and IOCs, piped into your stackExplore the API