Void Dokkaebi Supply Chain Malware in Tailwind Configs

Void Dokkaebi (also known as Famous Chollima or UNC5342), a North Korea-aligned threat actor, has been observed targeting software developers through supply chain contamination. The actor injects highly obfuscated JavaScript payloads into common configuration files such as `tailwind.config.js` and `routes/user.js`. These injections often occur within active development environments, such as VSCode workspaces, and may involve tampering with local git history to hide the attacker's presence.

The technical analysis reveals a multi-layered obfuscation strategy designed to bypass standard antivirus and macOS security features. Once executed during build time or server runtime, the malware initiates command-and-control (C2) communication using JSON-RPC calls to public blockchain infrastructure, specifically the TRON (`api.trongrid.io`) and Aptos networks. This infrastructure is resilient against traditional server takedowns, complicating remediation efforts.

This threat is particularly critical for organizations using Node.js and modern frontend frameworks, as the malware spreads through the trust-based nature of open-source collaboration (cloning, forking, and pulling repos). The impact includes the theft of secrets, API keys, and cryptocurrency credentials, as well as the potential for infected developer machines to be used as lures for further supply chain attacks.