Lazarus 'Graphalgo' Malicious Package Self-Cleanup

Ethan Andrews@eandrews

•updated Feb 12, 2026•6•0•78

Detects the modification or deletion of specific JavaScript or Python files shortly after a Node.js or Python interpreter starts. This behavior is characteristic of the 'self-patching' and 'evidence removal' techniques used by the Lazarus Group's Graphalgo malware.