malware npm
changelog-logger-utilities
discovered 2026-05-28Contagious Trader package published by toskypi (Mar 15, 2026). Exfiltrates to changelog[.]rest. Attributed to DPRK Famous Chollima via toskypi identity.
Threat types
credential_stealer data_exfiltration
Malicious versions
- 1.0.0
