North Korean threat actors have distributed over 200 malicious open source packages, in an audacious new cyber-espionage campaign, according to Sonatype. The security vendor blocked 234 unique npm and PyPI malware packages in the first half of 2025 alone, claiming they may have compromised as many as 36,000 victims. Sonatype attributed the campaign to the notorious Lazarus Group, claiming it represents a “strategic shift” for the state-backed actors. They apparently targeted open source in this way because developers often install packages without verification or sandboxing, CI/CD systems propagate malicious dependencies automatically and embedded malicious code can persist for lengthy periods. Many of the packages detected were designed to impersonate or resemble legitimate development…