A small JavaScript stealer with fingerprints of North Korean developer-targeting campaigns has been found riding a cluster of malicious packages.
Socket finds 737 VPN and proxy add-ons funneling browser sessions through a single provider.