GHAPPIER - One loader, sixty-five repositories, twenty-two accounts: an unreported loader family beside DPRK's PolinRider campaign

A sophisticated, previously unreported loader campaign compromised a legitimate npm package via stolen developer credentials, deploying a multi-stage, self-deleting implant across at least 65 repositories and 22 accounts, with infrastructure and indicators linking it to the DPRK-attributed PolinRider operation—yet leaving no public advisories or warnings for affected users.