A July 2024 software supply-chain roundup notes that North Korean threat actors published multiple malicious npm packages targeting developers, with activity reportedly continuing for about a year. Some of the npm packages mimicked trusted or popular packages while adding malicious functionality, placing developer environments and downstream open-source users at risk. The same source lists related IOCs, including package names resembling AliCloud, Tencent Cloud, and Python SDK tooling, plus command-and-control URLs and infrastructure. The DPRK-relevant section matters because it shows North Korean operators continuing to abuse public package ecosystems as an access vector into developer workflows.