North Korean actors distributed PondRAT through malicious Python packages uploaded to PyPI, targeting developers and the software supply chain. The packages posed as legitimate libraries but triggered malware installation on developer systems after use. PondRAT is described as a lighter macOS and Linux backdoor with file upload, file download, pause, and arbitrary command execution capabilities. The campaign shows how poisoned open source packages can give attackers access to developer endpoints that may later be used to reach vendors and customers.