Lazarus Group's Latest: Brandjacking Campaign on npm

Sonatype reports a Lazarus Group npm campaign using dozens of malicious, brandjacking packages that mimic trusted ecosystems to deliver follow-on payloads. Analysis of buffer-utilities shows a dropper that fetches and executes remote code and can establish persistent attacker-controlled activity, so affected installs should be treated as potentially compromised.