#ParsedReport #CompletenessMedium
01-09-2026

A malicious npm package hidden three dependencies deep: the ulid-xyz delivery chain

https://safedep.io/ulid-xyz-transitive-dependency-delivery-chain/

Report completeness: Medium

Actors/Campaigns:
Famous_chollima

Threats:
Supply_chain_technique

Victims:
Software development

Geo:
Dprk, Germany

TTPs:
Tactics: 2
Technics: 0

ChatGPT TTPs:
do not use without manual check
T1005, T1027.013, T1036.005, T1053.005, T1059.007, T1071.001, T1082, T1083, T1105, T1140, have more...

IOCs:
File: 2
Email: 2
IP: 3
Url: 2
Hash: 3

Soft:
macOS, Linux, Redis, Node.js, systemd, Telegram, HuggingFace

Algorithms:
xor, sha256, base64

Platforms:
cross-platform