Dead Drops on the Blockchain: Reversing a DPRK npm Loader (PolinRider / A6-Shadow-15)

North Korean threat actors deployed a sophisticated npm supply-chain attack using functional decoy packages that trigger a multi-layered, blockchain-based dead-drop loader—making payload delivery censorship-proof and resilient, while ultimately deploying a powerful RAT and evading traditional detection methods.