
- Lazarus Group evolving Operation Dream Job campaign to target Web3 developers
- New “Graphalgo” variant uses malicious dependencies in legitimate bare-bone projects on PyPI/npm
- ReversingLabs found ~200 malicious packages spoofing libraries like graphlib, aiming to steal crypto