Lazarus Contagious Interview Hijacked npm/Go Package Payload Delivery

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•6

Detects the execution of known malicious or hijacked npm and Go packages associated with the Lazarus Group 'Contagious Interview' supply chain campaign. The rule monitors for node.exe or go.exe spawning unexpected child processes like shells or download utilities (e.g., curl, powershell) and the presence of specific malicious package names in command lines.