#ParsedReport #CompletenessLow
21-09-2026

GHAPPIER - One loader, sixty-five repositories, twenty-two accounts: an unreported loader family beside DPRK's PolinRider campaign

https://www.cloudsek.com/blog/ghappier-malware-loader-npm-supply-chain-attack

Report completeness: Low

Actors/Campaigns:
Polinrider

Threats:
Ghappier
Polinrider
Nullreceiver_technique

Victims:
Software development

Geo:
Dprk, North korea

ChatGPT TTPs:
do not use without manual check
T1027.009, T1070.004, T1078, T1102.001, T1195.002

Crypto:
ethereum