North Korea's OtterCookie Malware Hid Inside a Fake Gemini npm Package — Cursor, Claude, and Windsurf Users Targeted

A North Korean supply chain attack has been targeting AI developer tooling since late March 2026. The vehicle: an npm package called gemini-ai-checker, published on March 20, that posed as a Google Gemini API token validator while silently downloading a JavaScript backdoor linked to the OtterCookie malware family.

The backdoor is attributed with high confidence to North Korea’s “Contagious Interview” operation — the same campaign that has spent the last two years placing fake IT contractors at tech companies and running poisoned npm packages against developers.

What the package did

Once installed, gemini-ai-checker reached out to a Vercel-hosted command-and-control server and pulled down a JavaScript payload. That payload did three things:

1. Harvested API keys from environment files (.env, .env.local) and configuration directories
2. Exfiltrated conversation logs and source code from directories created by Cursor, Claude for Desktop, Windsurf, PearAI, Gemini CLI, and Eigent AI
3. Established persistence for ongoing credential monitoring

The targeting of AI tool directories is deliberate. Developers working with these tools often have long-lived API keys, model-specific configurations, and sensitive project code sitting in predictable local paths. One install equals access to everything the developer has been building with those tools.

Related packages

Two additional packages shared the same Vercel C2 infrastructure: express-flowlimit and chai-extensions-extras. All three packages had combined downloads exceeding 500 at time of reporting. Both companion packages remain on npm pending removal.

Immediate action required

If you have installed gemini-ai-checker, express-flowlimit, or chai-extensions-extras:

# Remove the packages immediately
npm uninstall gemini-ai-checker express-flowlimit chai-extensions-extras

# Rotate every API key that was accessible in your dev environment
# Check: OpenAI, Anthropic, Google AI, GitHub, AWS, etc.

Assume any key in .env files or AI tool config directories has been exfiltrated. Rotate before revocation — don’t wait.

Broader pattern

This is the fourth confirmed Contagious Interview npm campaign in the last 18 months. Previous waves targeted cryptocurrency developers, blockchain tooling, and now AI coding assistants. The shift to AI developer tools is logical: these users have access to powerful APIs, high-value codebases, and often work in environments with fewer security controls than large enterprises.

The attack also exploits the trust developers place in packages that look like legitimate companion tools for popular APIs. gemini-ai-checker looked plausible — Google has a public Gemini SDK with token quota mechanics that a validator package could reasonably address.

What to check going forward

Before installing any package with “ai”, “gemini”, “claude”, “openai”, or similar terms in its name: verify the publisher on npmjs.com, check download counts, and read the source. The official Google Generative AI SDK is @google/generative-ai, published by Google LLC. Anything else claiming Gemini affiliation is suspect.

Report suspicious packages at npmjs.com/support or GitHub Security Advisories.