lib/writer.js lib/main.js present (per npm-index) primary loader loaders/big.js src/index.js primary loader primary loader index.js primary loader primary loader primary loader primary loader src/index.js primary loader primary loader lib/main.js primary loader primary loader npm/path-addon/1.0.2/l… primary loader primary loader primary loader primary loader primary loader primary loader primary loader primary loader primary loader primary loader primary loader primary loader primary loader lib/initializeCaller.js primary loader primary loader loaders/sign.js primary loader loaders/test.js loaders/test.js loaders/postinstall.js test.js loaders/test.js loaders/scripts/upgrad… test.js loaders/test.js lib/initializeCaller.js loaders/index.js primary loader primary loader primary loader index.js primary loader primary loader primary loader primary loader primary loader primary loader rest-icon-handler.store www.isillegalregion.com changelog.rest coingecko-liard.vercel… logger.clob.health www.jsonkeeper.com api-sub.jrodacooker.dev payloads-el.pages.dev deoft.online cloudflareinsights.ver… cloudflareshield.verce… cloudflaresecurity.ver… drive.google.com api.mywalletsss.store axioshealthcheck.verce… api.npoint.io apiscriptv3.vercel.app cloudflareguard.vercel… cloudflarefirewall.ver… jsonkeeper.com lib polymarkettrading.verc… api.trongrid.io fullnode.mainnet.aptos… bsc-dataseed.binance.org bsc-rpc.publicnode.com jsonspack.com nexafilm.com locate-my-ip.vercel.app npmjs-doc-builder.verc… log.pricesheet.ink server-check-genimi.ve… server-genimi-check.ve… chalk-logger.vercel.app webrtc-signal-schedule… navigatorshub.com ghostraper.top polymarket-bots-backen… isillegalregion.com wallet-management-tg-b… cloudflare-protection.… api.telegram.org slack.com log.pricesheet.io api.fivefingerz.dev srv141316.hosttoname.com TMfKQEd7...mAP TXfxHUet...cG 0xbe037...811e 0x3f0e5...dce3 TA48dct...D3v ts-lint-builds cjs-biginteger graphbase-js json-spacer json-dec prettier-logger json-lucide rollup-plugin-polyfill… chai-as-mobj graphbase-js jonas-prettier-logger jonas-prettier-logger jonas-prettier-logger express-flowlimit express-flowlimit express-flowlimit json-lucide json-spacer gleb-js ts-utils-dev ts-utils-dev graphbase-js react-native-template-… psxjson sol-sdk ts-lint-builders mjs-biginteger chalk-logger-prettier levex-press ts-relayer-client ts-big-lib ts-big-lib df-vision jsontoken-extend graphbase-js path-internal path-internal path-internal path-internal path-internal mexc-utils-helper modustack bundrix chalk-prettier chalk-prettier express-lib-validator path-extend chai-str chai-beta chai-as-encrypted chai-as-chain-v2 vime-azl ts-bing react-svg-animator react-svg-animator chai-as-hooked chai-as-evm chai-as-adapter chai-use-chain emojiprint-prettier coremeshnode coremesh chai-chain-coremesh tailwind-configuration relion-chain wime-zle ts-bigtn ts-bigtn tailwind-animationbasic peptide-init df-vision changelog-cli-logger node-syncora chain-syncora jsontoken-extend vite-plugin-compress-p… vite-plugin-compress-p… vite-plugin-compress-p… peptide-score chalk-standard metrify-node metrify-chain peptideenv pretty-pino-loggers df-vision tailwindcss-typeface-i… tailwindcss-typeface-i… swplayer-react-sl express-auth-basic jellyfi-pino-pretty-lo… peptideenv json-spacer pretty-fancy tailwind-scroller path-extend buffer-util-extend buffer-util-extend buffer-util-extend buffer-util-extend peptideenv node-metrica chain-metrica digitallogger winston-prisma winston-prisma winston-prisma winston-prisma winston-prisma trackora-chain trackora-node changelog-cli-logger pino-pretty-logs changelog-cli-logger chai-extensions-extra request-easy-validator chai-extensions-extras express-flowlimit request-easy-validator request-easy-validator tailwindcss-fonttype-i… changelog-cli-logger changelog-cli-logger changelog-cli-logger changelog-cli-logger changelog-cli-logger changelog-cli-logger js-logger-pack js-logger-pack js-logger-pack npmjs-doc-builder bign.tsm bign.tsm cli-pretty-logger terminal-pretty-logger terminal-pretty-logger terminal-pretty-logger terminal-pretty-logger express-session-js test-prettier chalks-logger chai-as-inserted pathfix log-upgrade simple-auth-basic simple-auth-basic simple-auth-basic simple-auth-basic simple-auth-basic simple-auth-basic tailwind-stylecss-typo… tailwind-typography-cs… winston-prism request-js-validator anaylze-json devkitx devkitx pathfix express-flowlimit chai-extensions-extras chai-as-type next-runtimejs next-runtimejs reactvora devkitx request-js-validator request-js-validator bulletproof-json path-addon sjs-lint-build1 sjs-biginteger sjs-biginteger hjs-lint-builders hjs-biginteger pino-pretty-logs pino-pretty-logs pino-pretty-logs bjs-lint-builders bjs-biginteger peptideenv peptideenv bjs-lint-builders pathfix bjs-lint-builder bjs-biginteger sjs-builders st-biginteger next-runtimejs next-runtimejs eslint-vite eslint-vite eslint-vite sjs-builder st-bigintr df-vision transportator transportator lint-nule big-numer color-cli-log color-cli-log sleek-pretty df-vision path-extend path-addon env-axios cookie-parseflow tailwind-text-fill js-unimode js-unimode js-unimode peptideenv lint-nuler bigint.fs awesome-cli-logger lint-null bigint.os js-unimode js-unimode path-extend path-extend react-saga-redux react-saga-redux react-saga-redux react-saga-redux react-saga-redux chai-as-refined mongoose-lean-hooks mongoose-lean-hooks chai-as-optimized chai-as-encrypted chai-as-encrypted chai-as-encrypted chai-as-encrypted chai-as-encrypted byteboxlab pretty-logger-js pretty-logger-js pretty-logger-js terminal-formatter chai-as-nobj chai-as-nobj chai-as-nobj chai-as-ide tsjson-config tsjson-config tsconfig-json-resolver vite-json-config chai-as-stream chai-as-init byteutilsbox vite-enhancer-config vite-enhancer-config vite-enhancer-config vite-enhancer-config env-nodejs path-addon dotenv-pack chai-as-elevated argonflux@2.0.1 vite-enhancer-config path-internal@1.0.7 Cluster C Cloudflare Pages / deoft.online Cluster B BeaverTail delivery variants Cluster E TS / cred / SSH stealers Cluster G isillegalregion.com loaders Cluster A OtterCookie loader chain Cluster I blockchain dead-drop C2 Cluster F Vercel SSH / Solana stealers Cluster H trojanized debug library Cluster D npoint-hosted RAT family INDICATOR TYPE package identity email domain hash loader stage asn ip port wallet path url PANTHER THREAT RESEARCH DPRK npm Supply Chain — 2026-03-20 to 2026-04-20 panther.com/threat-research
Campaign timeline
Use the slider: rewind the campaign day by day.
2026-03-20Visible packages: 02026-04-20