{
  "Event": {
    "analysis": "1",
    "date": "2026-04-10",
    "extends_uuid": "",
    "info": "[Threat Intel] Tracking an OtterCookie Infostealer Campaign Across npm",
    "protected": false,
    "publish_timestamp": "1776462986",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1776462985",
    "uuid": "832593d1-41f9-4dda-99ff-74d39b3f4472",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-original-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"OtterCookie\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#18005e",
        "local": false,
        "name": "rectifyq:topic=\"supply-chain\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#d596aa",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Compromise Software Supply Chain - T1195.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#68f2ff",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"",
        "relationship_type": ""
      },
      {
        "colour": "#a9f8b1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"",
        "relationship_type": ""
      },
      {
        "colour": "#0c0051",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Impersonation - T1656\"",
        "relationship_type": ""
      },
      {
        "colour": "#d3f567",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"JavaScript - T1059.007\"",
        "relationship_type": ""
      },
      {
        "colour": "#7da4ad",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Match Legitimate Resource Name or Location - T1036.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"SSH Authorized Keys - T1098.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d7034",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"",
        "relationship_type": ""
      },
      {
        "colour": "#7628f7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Unix Shell - T1059.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#3500ca",
        "local": false,
        "name": "rectifyq:detection-rules=\"yara-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776135631",
        "to_ids": false,
        "type": "link",
        "uuid": "a0a071aa-f484-460d-bb18-d1e9e4142d7f",
        "value": "https://panther.com/blog/tracking-an-ottercookie-infostealer-campaign-across-npm",
        "Tag": [
          {
            "colour": "#6b003a",
            "local": true,
            "name": "workflow:todo=\"create-missing-misp-galaxy-cluster\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776135631",
        "to_ids": false,
        "type": "text",
        "uuid": "bb91bac9-d257-44fe-b973-65e3c7096ada",
        "value": "Between April 6-9, 2026, multiple obfuscated malicious npm packages were identified as variants of the OtterCookie infostealer attributed to North Korean threat actors. The campaign employs a two-layer distribution strategy where benign wrapper packages clone legitimate libraries like big.js while pulling malicious dependencies containing the actual payload. Five malicious packages were identified, each containing obfuscated JavaScript files that execute via postinstall hooks. The toolchain steals credentials, files including Solana wallets and environment configurations, and exfiltrates data to Vercel-hosted C2 infrastructure. On Linux systems, it establishes persistence through SSH backdoor installation. The infrastructure overlaps with documented OtterCookie operations and connects to broader DPRK campaigns including Contagious Interview and Contagious Trader, demonstrating continued evolution in North Korean software supply chain attacks targeting developers."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776135631",
        "to_ids": false,
        "type": "text",
        "uuid": "fb2d2e81-773d-45b9-8807-31cae77bfeeb",
        "value": "Name: Tracking an OtterCookie Infostealer Campaign Across npm\nAuthor: AlienVault\nAdversary: FAMOUS CHOLLIMA\nTags: [\"credential theft\", \"koalemos\", \"contagious interview\", \"infostealer\", \"invisibleferret\", \"ssh backdoor\", \"vercel c2\", \"beavertail\", \"npm\", \"ottercookie\", \"javascript obfuscation\", \"north korea\", \"supply-chain\"]\nTgtd countries: []\nMlwr families: [\"OtterCookie\", \"BeaverTail\", \"InvisibleFerret\", \"Koalemos\"]\nAttack_ids: []\nIndustries: [\"Technology\"]"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776135631",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "9a70c64e-7d4d-4bac-be4a-e19addbdaa0f",
        "value": "FAMOUS CHOLLIMA"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776401538",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "7d377878-7365-4c57-9a9b-80cd6dc19df3",
        "value": "144.172.110.228",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776401559",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57d885b4-b937-4385-b211-3aefed73a42e",
        "value": "107.189.22.20",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776401580",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "e9b2d952-5ed2-428c-84a5-55b18ce5cc98",
        "value": "144.172.110.132",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776401601",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "a9bc9d25-e246-4c19-8608-c2ed50402f01",
        "value": "144.172.110.96",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776401623",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "9f7c9e42-be3a-4ccd-896b-c5fc807206d1",
        "value": "144.172.116.22",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776401644",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "8d253e52-2a9c-4999-a3a1-f90a8cbefd79",
        "value": "144.172.93.169",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776401665",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "47cdb43b-4ccc-472f-93f6-88625ff356a3",
        "value": "144.172.93.253",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776401686",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "52a044ad-91f4-4dac-af6d-f093cde8291d",
        "value": "144.172.99.248",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776401707",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "adac24e2-d153-4679-ad7a-b41d14f1f60b",
        "value": "144.172.99.81",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776355943",
        "to_ids": true,
        "type": "email-src",
        "uuid": "8e05ab4a-3ec2-4580-95f8-6e0848957da2",
        "value": "a.l.l.a.nh.orca0.7@googlemail.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776401729",
        "to_ids": true,
        "type": "hostname",
        "uuid": "4cf87117-2ed8-4d00-bd91-f1ec1bea1f46",
        "value": "nar.a.tat.ia.n.aaa",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776355943",
        "to_ids": true,
        "type": "email-src",
        "uuid": "007e7efc-f0df-41ab-9d3e-22aee0585d32",
        "value": "nar.a.tat.ia.n.aaa@gmail.com"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776355943",
        "to_ids": true,
        "type": "email-src",
        "uuid": "6686e0b8-d0a8-4f9d-ae95-55d39434cbe4",
        "value": "ayal.a.d.av.e.7@gmail.com"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776355943",
        "to_ids": true,
        "type": "email-src",
        "uuid": "c8a7debd-0d43-4ec8-833f-106e788dfa1b",
        "value": "a.n.n.as.ibal2.36@googlemail.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776401750",
        "to_ids": true,
        "type": "hostname",
        "uuid": "f6a2318a-560c-456a-b15f-802b2283818a",
        "value": "al.lanjaysa.t.i.a.gi",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776355943",
        "to_ids": true,
        "type": "email-src",
        "uuid": "df685c3a-60c6-43f5-ab65-d1880e8381ad",
        "value": "al.lanjaysa.t.i.a.gi@gmail.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776401771",
        "to_ids": true,
        "type": "hostname",
        "uuid": "2596151e-b27e-4e24-8d5b-4723c736f97a",
        "value": "cloudflareinsights.vercel.app",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776401792",
        "to_ids": true,
        "type": "hostname",
        "uuid": "7cdd59dd-d2a6-4282-b737-40bb6bea712e",
        "value": "cloudflarefirewall.vercel.app",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776401813",
        "to_ids": true,
        "type": "hostname",
        "uuid": "cdcb9413-bab8-4d8c-af99-ac1243e16172",
        "value": "cloudflaresecurity.vercel.app",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "An object describing a YARA rule (or a YARA rule name) along with its version.",
        "meta-category": "misc",
        "name": "yara",
        "template_uuid": "b5acf82e-ecca-4868-82fe-9dbdf4d808c3",
        "template_version": "7",
        "timestamp": "1776356044",
        "uuid": "8b62d803-7225-4769-be84-e428273ea1ca",
        "Attribute": [
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "yara-rule-name",
            "timestamp": "1776356044",
            "to_ids": false,
            "type": "text",
            "uuid": "f820a19e-cd17-45e2-a581-d8490e88a58d",
            "value": "OtterCookie_NPM_Base91_Stealer"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "comment",
            "timestamp": "1776356044",
            "to_ids": false,
            "type": "comment",
            "uuid": "361b60c4-1fae-4dcb-9e31-0b81f4caefc4",
            "value": "Detects OtterCookie npm stealer with custom base91 encoding"
          },
          {
            "category": "Payload installation",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "yara",
            "timestamp": "1776356044",
            "to_ids": true,
            "type": "yara",
            "uuid": "31ae3201-09ea-44dc-8156-3c9013ee3acb",
            "value": "rule OtterCookie_NPM_Base91_Stealer {\r\n    meta:\r\n        description = \"Detects OtterCookie npm stealer with custom base91 encoding\"\r\n        author = \"PantherLabs\"\r\n        date = \"2026-04-09\"\r\n        reference = \"<https://medium.com/walmartglobaltech/mapping-ottercookie-infrastructure-1c49f0cd3883>\"\r\n\r\n    strings:\r\n        $const_array = /const\\\\s+\\\\w+\\\\s*=\\\\s*\\\\[0x0,\\\\s*0x1,\\\\s*0x8,\\\\s*0xff,\\\\s*\"length\",\\\\s*\"undefined\",\\\\s*0x3f/\r\n        $from_code_point = \"\\\\\"fromCodePoint\\\\\"\" ascii\r\n        $push_method = \"\\\\\"push\\\\\"\" ascii\r\n        $base91_magic1 = \"0x5b\" ascii\r\n        $base91_magic2 = \"0x1fff\" ascii\r\n        $base91_magic3 = \"0x58\" ascii\r\n        $utf8_decoder = \"fromCharCode\" ascii\r\n        $alphabet_pattern = /var\\\\s+\\\\w+\\\\s*=\\\\s*\"[^\\\\\\\\\"]{85,95}\"/\r\n\r\n    condition:\r\n        filesize < 200KB and\r\n        $const_array and\r\n        $from_code_point and\r\n        $push_method and\r\n        all of ($base91_magic*) and\r\n        $utf8_decoder and\r\n        #alphabet_pattern > 3\r\n}"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An object describing a YARA rule (or a YARA rule name) along with its version.",
        "meta-category": "misc",
        "name": "yara",
        "template_uuid": "b5acf82e-ecca-4868-82fe-9dbdf4d808c3",
        "template_version": "7",
        "timestamp": "1776356068",
        "uuid": "58b621a9-4545-4cfc-8c96-38e378ea69ec",
        "Attribute": [
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "yara-rule-name",
            "timestamp": "1776356068",
            "to_ids": false,
            "type": "text",
            "uuid": "2f6e00aa-d271-47e6-8042-0d301f1e77f1",
            "value": "OtterCookie_NPM_Loader"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "comment",
            "timestamp": "1776356068",
            "to_ids": false,
            "type": "comment",
            "uuid": "ed37c9cf-2c0d-4ed5-9d6b-b3b47aba0556",
            "value": "Detects OtterCookie npm loader component"
          },
          {
            "category": "Payload installation",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "yara",
            "timestamp": "1776356068",
            "to_ids": true,
            "type": "yara",
            "uuid": "52eacd69-14a4-415b-962a-45131b27bbe7",
            "value": "rule OtterCookie_NPM_Loader {\r\n    meta:\r\n        description = \"Detects OtterCookie npm loader component\"\r\n        author = \"PantherLabs\"\r\n        date = \"2026-04-09\"\r\n\r\n    strings:\r\n        $const_array = /const\\\\s+\\\\w+\\\\s*=\\\\s*\\\\[0x0,\\\\s*0x1,\\\\s*0x8,\\\\s*0xff,\\\\s*\"length\",\\\\s*\"undefined\"/\r\n        $require_dot = \"require(\\\\\".\\\\\")\" ascii\r\n        $async_try = /async\\\\s+function\\\\s+\\\\w+\\\\(\\\\)\\\\s*\\\\{\\\\s*try\\\\s*\\\\{\\\\s*await\\\\s+\\\\w+\\\\(\\\\)/\r\n        $silent_catch = /catch\\\\s*\\\\(\\\\s*\\\\w*\\\\s*\\\\)\\\\s*\\\\{\\\\s*\\\\}/\r\n\r\n    condition:\r\n        filesize < 50KB and\r\n        $const_array and\r\n        $require_dot and\r\n        $async_try and\r\n        $silent_catch\r\n}"
          }
        ]
      }
    ]
  }
}