DPRK Contagious Trader SSH Backdoor NPM Correlation
High-fidelity correlation detecting DPRK Contagious Trader npm malware persistence: Node.js process modifying authorized_keys followed by ufw allowing SSH. Targets cryptocurrency traders via poisoned GitHub trading bot repositories.
YARA-L
