INFOSEC IN BRIEF North Korea’s Lazarus Group has changed tactics and is now creating malware-laden open source software. Software supply chain management vendor Sonatype last week published research in which it claimed that Lazarus Group has created hundreds of “shadow downloads” that appear to be popular open source software development tools but are full of malware. The company says it found 234 unique malware packages built by Lazarus in the first half of 2025 alone. “Lazarus has increasingly pivoted from disruption to long-term infiltration, using tailored malware, modular payloads, and infrastructure evasion techniques to achieve persistent access to high-value targets — including the open source software ecosystem,” the company’s researchers wrote. Lazarus Group’s rap sheet includes…