Skip to main content
AVOID.NET
← Lazarus Group 'Graphalgo' Fake-Recruiter npm/PyPI Campaignreviewed 2026-09-06 · 37 claims checked

Fact-check findings

What an automated fact-checker found when it re-read Lazarus Group 'Graphalgo' Fake-Recruiter npm/PyPI Campaign against the sources the page cites. Only the most recent review is shown.

Read this first

These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.

“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.

Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.

disputed 5unverifiable 1partially supported 1confirmed 305 corrections pending · 0 applied

disputed

5 claims

The reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.

  1. #3[disputed][awaiting moderator]in the summary
    “By April 2026 the campaign had respawned under new personas including 'Blockmerce' and 'Bridgers Finance', with operatives registering a real U.S. LLC to enhance credibility.”
    reviewerBy April 2026 the campaign had respawned under new personas including 'Blockmerce' and 'Bridgers Finance'.The page itself correctly writes 'Blocmerce LLC' in the body of section 6, but the summary, the section 6 heading, the section 8 infrastructure list, and the April 2026 timeline entry all use the misspelling 'Blockmerce', which matches neither the cited ReversingLabs source nor the Florida corporate registry.
    Proposed correction (not yet applied)
    By April 2026 the campaign had respawned under new personas including 'Blocmerce' and 'Bridgers Finance', with operatives registering a real U.S. LLC to enhance credibility.
    citedwww.reversinglabs.com/blog/graphalgo-campaign-respawnedhackread.com/graphalgo-scam-lazarus-hack…us-llcs-malware/
  2. #20[disputed][awaiting moderator]in section: Campaign Respawn: Blockmerce, Bridgers Finance, and U.S. LLC Registration
    “Campaign Respawn: Blockmerce, Bridgers Finance, and U.S. LLC Registration”
    reviewerThe section 6 heading names the new persona 'Blockmerce'.Same underlying error as the summary and section 8 occurrences; the section's own body text three sentences later correctly says 'Blocmerce LLC'.
    Proposed correction (not yet applied)
    Campaign Respawn: Blocmerce, Bridgers Finance, and U.S. LLC Registration
    citedwww.reversinglabs.com/blog/graphalgo-campaign-respawned
  3. #26[disputed][awaiting moderator]in section: Precedent Campaigns and Lazarus Group Context
    “https://home.treasury.gov/news/press-releases/sm924”
    reviewerThe March 12, 2026 OFAC sanctions announcement is properly sourced to home.treasury.gov/news/press-releases/sm924.The underlying claim in the section text is correct, but the specific source citation attached to it (sm924) is a live, on-topic-adjacent Treasury page that does not actually support the March 2026 sanctions claim — it documents a different, earlier action. This is a citation mismatch rather than link rot.
    Proposed correction (not yet applied)
    https://home.treasury.gov/news/press-releases/sb0230
    citedhome.treasury.gov/news/press-releases/sm924
  4. #28[disputed][awaiting moderator]in section: Known Infrastructure and Indicators of Compromise
    “GitHub organizations: veltrix-capital, veltrixcapital, swft-blockchain (typosquatting SWFT Blockchain), Blockmerce.”
    reviewerGitHub organizations connected to the campaign include Blockmerce.Same underlying misspelling as the summary, section 6 heading, and the April 2026 timeline entry.
    Proposed correction (not yet applied)
    GitHub organizations: veltrix-capital, veltrixcapital, swft-blockchain (typosquatting SWFT Blockchain), Blocmerce.
    citedwww.reversinglabs.com/blog/graphalgo-campaign-respawned
  5. #37[disputed][awaiting moderator]in the timeline
    “ReversingLabs documents campaign respawn under Blockmerce and Bridgers Finance personas, with new C2 domain huvaret[.]art and shift to GitHub release artifact delivery.”
    reviewerTimeline: The April 2026 respawn is described as documenting Blockmerce and Bridgers Finance personas.Fourth occurrence of the same misspelling; grouped under defect_group blocmerce-llc-misspelling with the summary, section 6 heading, and section 8 infrastructure list.
    Proposed correction (not yet applied)
    ReversingLabs documents campaign respawn under Blocmerce and Bridgers Finance personas, with new C2 domain huvaret[.]art and shift to GitHub release artifact delivery.
    citedwww.reversinglabs.com/blog/graphalgo-campaign-respawned

unverifiable

1 claim

No source the reviewer could reach confirms or contradicts the claim.

  1. #6[unverifiable][awaiting moderator]in section: Campaign Overview and Attribution
    “No formal U.S. government attribution advisory specific to graphalgo has been published as of June 2026, though Lazarus Group as an entity was designated by the U.S. Treasury OFAC and the FBI has previously attributed multiple Lazarus operations by name.”
    reviewerNo formal U.S. government attribution advisory specific to graphalgo has been published as of June 2026.A negative claim (absence of an advisory) cannot be conclusively confirmed; no contrary evidence of a formal graphalgo-specific government advisory was found either, through September 2026.

partially supported

1 claim

The cited evidence supports part of the claim but not all of it.

  1. #27[partially supported][awaiting moderator]in section: Known Infrastructure and Indicators of Compromise
    “Typosquatting example: fake npm account 'Ijharb' (capital I replacing lowercase L in 'ljharb', the account of developer Jordan Harband) distributing malicious 'side-channel-weakmap' package.”
    reviewerA fake npm account 'Ijharb' (capital I for lowercase l) distributed a malicious 'side-channel-weakmap' package, typosquatting developer Jordan Harband's 'ljharb' account.The typosquatting incident itself is well documented and attributed to North Korea-linked actors, but independent reporting more often ties the ljharb/axios-adjacent phishing and typosquat incident to a broader Lazarus npm-targeting pattern rather than specifically and exclusively to the graphalgo campaign as documented by ReversingLabs; the page presents it as a graphalgo IOC without a source that explicitly names it as part of this specific operation.
    citedwww.reversinglabs.com/blog/inside-graphalgo

confirmed

30 claims

The cited evidence supports the claim as written.

  1. #1[confirmed][no action needed]in the summary
    “active since at least May 2025 and publicly disclosed in February 2026”
    reviewerThe campaign has been active since at least May 2025.Matches ReversingLabs' own timeline for the first malicious npm package.
    citedwww.reversinglabs.com/blog/inside-graphalgo
  2. #2[confirmed][no action needed]in the summary
    “active since at least May 2025 and publicly disclosed in February 2026”
    reviewerThe campaign was publicly disclosed in February 2026.Multiple February 2026 outlets (The Hacker News, Security Affairs, GBHackers) corroborate the disclosure window.
    citedwww.reversinglabs.com/blog/inside-graphalgothehackernews.com/2026/02/lazarus-campai…s-malicious.html
  3. #4[confirmed][no action needed]in section: Campaign Overview and Attribution
    “The graphalgo campaign is named after the first malicious npm package published in the operation, graphalgo version 2.2.6, which appeared on May 2, 2025.”
    reviewergraphalgo version 2.2.6, the first malicious npm package in the campaign, appeared on May 2, 2025.Directly confirmed by the primary source.
    citedwww.reversinglabs.com/blog/inside-graphalgo
  4. #5[confirmed][no action needed]in section: Campaign Overview and Attribution
    “Attribution rests on multiple indicators: Git commit timestamps consistently aligned with GMT+9 (North Korea Standard Time), attack methodology mirroring the 2023 VMConnect and Jade Sleet PyPI/GitHub campaigns, a shared token-protected command-and-control (C2) communication technique previously documented only in North Korean operations, and targeting patterns focused exclusively on cryptocurrency developers and wallets.”
    reviewerAttribution rests on Git commit timestamps aligned with GMT+9, methodology mirroring VMConnect and Jade Sleet, a shared token-protected C2 technique, and crypto-developer targeting.Each individual attribution indicator was independently verified against the two RL blogs and The Hacker News.
    citedwww.reversinglabs.com/blog/fake-recruite…aign-crypto-devsthehackernews.com/2026/02/lazarus-campai…s-malicious.html
  5. #7[confirmed][no action needed]in section: Campaign Overview and Attribution
    “The campaign is assessed as ongoing, with a respawned variant documented by ReversingLabs in April 2026.”
    reviewerA respawned variant of the campaign was documented by ReversingLabs in April 2026.Confirmed against the primary source's publication date.
    citedwww.reversinglabs.com/blog/graphalgo-campaign-respawned
  6. #8[confirmed][no action needed]in section: Fake Company Infrastructure: Veltrix Capital
    “The domain veltrixcap[.]org was registered on April 4, 2025, approximately one month before the first malicious package appeared.”
    reviewerThe domain veltrixcap[.]org was registered on April 4, 2025.Directly confirmed.
    citedwww.reversinglabs.com/blog/fake-recruite…aign-crypto-devs
  7. #9[confirmed][no action needed]in section: Fake Company Infrastructure: Veltrix Capital
    “A backup domain, veltrixcapital[.]ai, was registered on September 21, 2025, likely to provide continuity when the first domain risked exposure.”
    reviewerA backup domain, veltrixcapital[.]ai, was registered on September 21, 2025.Directly confirmed.
    citedwww.reversinglabs.com/blog/fake-recruite…aign-crypto-devs
  8. #10[confirmed][no action needed]in section: Fake Company Infrastructure: Veltrix Capital
    “The company's website carried AI-generated corporate vision and mission content.”
    reviewerThe Veltrix Capital website carried AI-generated corporate vision and mission content.Confirmed via secondary reporting quoting ReversingLabs.
    citedwww.reversinglabs.com/blog/fake-recruite…aign-crypto-devs
  9. #11[confirmed][no action needed]in section: Malicious Package Inventory
    “ReversingLabs researchers identified a total of 192 malicious packages spread across npm and PyPI in two naming waves.”
    reviewerReversingLabs identified 192 total malicious packages, 106 on npm and 86 on PyPI.Total and per-registry split both confirmed.
    citedwww.reversinglabs.com/blog/inside-graphalgo
  10. #12[confirmed][no action needed]in section: Malicious Package Inventory
    “The first PyPI package appeared on June 13, 2025.”
    reviewerThe first PyPI package (graphalgo) appeared on June 13, 2025.Confirmed exactly.
    citedwww.reversinglabs.com/blog/inside-graphalgo
  11. #13[confirmed][no action needed]in section: Malicious Package Inventory
    “A second wave, beginning November 17, 2025 on npm and December 9, 2025 on PyPI, used 'big'-prefixed names, including bigmathutils, bigmathex, bigmathlib, bignumx, bignumberx, bignumex, bigmathix, bigpyx, and bignum.”
    reviewerA second wave of 'big'-prefixed packages began November 17, 2025 on npm and December 9, 2025 on PyPI.Confirmed.
    citedwww.reversinglabs.com/blog/inside-graphalgo
  12. #14[confirmed][no action needed]in section: Malicious Package Inventory
    “The package bigmathutils accumulated more than 10,000 downloads after an initially benign version established trust; the malicious payload version (v1.1.0) was published on February 11, 2026, then quickly removed and the package marked deprecated.”
    reviewerbigmathutils exceeded 10,000 downloads and the malicious v1.1.0 was published Feb 11, 2026, then removed and deprecated.Confirmed exactly against primary source.
    citedwww.reversinglabs.com/blog/fake-recruite…aign-crypto-devs
  13. #15[confirmed][no action needed]in section: Malware Technical Analysis
    “The second stage was hosted on GitHub at a raw content URL under the account 'johns92' (hxxps://raw.githubusercontent[.]com/johns92/blog_app/refs/heads/main/server/.env.example).”
    reviewerThe second-stage payload was hosted on GitHub under account 'johns92' at a specific raw content URL.Confirmed exactly, including the defanged URL format.
    citedwww.reversinglabs.com/blog/inside-graphalgo
  14. #16[confirmed][no action needed]in section: Malware Technical Analysis
    “Decryption uses a key derived from constructor arguments: when graph objects are instantiated with parameters such as 'weighted:true, directed:true', the decryption key 'weighted-directed-graph' is generated — a deliberate obfuscation technique to prevent sandbox detection.”
    reviewerDecryption uses a key derived from constructor arguments, e.g. 'weighted-directed-graph'.Confirmed.
    citedwww.reversinglabs.com/blog/inside-graphalgo
  15. #17[confirmed][no action needed]in section: Malware Technical Analysis
    “The final RAT payload communicates with C2 servers at codepool[.]cloud and aurevian[.]cloud via a token-based authentication mechanism that restricts commands to registered infected hosts — a technique documented as uncommon outside North Korean threat actor tooling.”
    reviewerThe RAT communicates with C2 servers at codepool[.]cloud and aurevian[.]cloud via a token-based authentication mechanism.Confirmed.
    citedwww.reversinglabs.com/blog/fake-recruite…aign-crypto-devs
  16. #18[confirmed][no action needed]in section: Malware Technical Analysis
    “A VBS payload variant was identified on February 4, 2026.”
    reviewerA VBS payload variant was identified on February 4, 2026.Confirmed exactly, down to the date.
    citedwww.reversinglabs.com/blog/fake-recruite…aign-crypto-devs
  17. #19[confirmed][no action needed]in section: Campaign Respawn: Blockmerce, Bridgers Finance, and U.S. LLC Registration
    “Most significantly, threat actors registered a real Florida LLC named 'Blocmerce LLC' in August 2025 under a fake CEO named 'Alexandre Miller', with physical addresses belonging to unrelated third parties.”
    reviewerThreat actors registered a real Florida LLC named 'Blocmerce LLC' in August 2025 under a fake CEO named 'Alexandre Miller'.This sentence, in the section body, correctly uses the spelling 'Blocmerce LLC' consistent with the Florida corporate registry and the RL source; see the separate finding on the 'Blockmerce' misspelling elsewhere on the page.
    citedwww.reversinglabs.com/blog/graphalgo-campaign-respawnedhackread.com/graphalgo-scam-lazarus-hack…us-llcs-malware/
  18. #21[confirmed][no action needed]in section: Campaign Respawn: Blockmerce, Bridgers Finance, and U.S. LLC Registration
    “Fake employee identities 'Dmytro Buryma' and 'Karina Lesova' appeared in both LLC filings and rewritten Git histories.”
    reviewerFake employee identities 'Dmytro Buryma' and 'Karina Lesova' appeared in both LLC filings and rewritten Git histories.Confirmed.
    citedwww.reversinglabs.com/blog/graphalgo-campaign-respawned
  19. #22[confirmed][no action needed]in section: Campaign Respawn: Blockmerce, Bridgers Finance, and U.S. LLC Registration
    “Additional personas included 'Bridgers Finance' (described as the central hub for ongoing frontend operations) and two accounts impersonating the legitimate SWFT Blockchain organization.”
    reviewer'Bridgers Finance' is described as the central hub for ongoing frontend operations.Confirmed, close paraphrase of the source.
    citedwww.reversinglabs.com/blog/graphalgo-campaign-respawned
  20. #23[confirmed][no action needed]in section: Campaign Respawn: Blockmerce, Bridgers Finance, and U.S. LLC Registration
    “The new C2 infrastructure uses the domain huvaret[.]art, with RAT delivery at huvaret[.]art/public/index.js and a Sepolia testnet smart contract (0x7526aCdCF0B22f9B8F790CF069E5dD16CC414B0e) used for logging, suggesting experimentation with blockchain-based C2 persistence.”
    reviewerNew C2 infrastructure uses domain huvaret[.]art, with a Sepolia testnet smart contract at 0x7526aCdCF0B22f9B8F790CF069E5dD16CC414B0e used for logging.Confirmed exactly, including the contract address.
    citedwww.reversinglabs.com/blog/graphalgo-campaign-respawned
  21. #24[confirmed][no action needed]in section: Precedent Campaigns and Lazarus Group Context
    “The group has been linked to over $5 billion in cryptocurrency theft between 2021 and 2025, including the February 2025 Bybit hack ($1.5 billion).”
    reviewerLazarus Group is assessed to be operated by North Korea's Reconnaissance General Bureau (RGB) and has been linked to over $5 billion in cryptocurrency theft between 2021 and 2025, including the February 2025 Bybit hack ($1.5 billion).Both the aggregate figure and the Bybit hack figure are independently corroborated.
    citedsanctionssearch.ofac.treas.gov/Details.aspx?id=27307
  22. #25[confirmed][no action needed]in section: Precedent Campaigns and Lazarus Group Context
    “On March 12, 2026, OFAC sanctioned six individuals and two entities connected to North Korean IT worker fraud schemes that generated approximately $800 million in 2024, reflecting the broader financial context in which graphalgo operates.”
    reviewerOn March 12, 2026, OFAC sanctioned six individuals and two entities connected to North Korean IT worker fraud schemes that generated approximately $800 million in 2024.Note: the page cites home.treasury.gov/news/press-releases/sm924 for this fact in the section sources, but that specific press release (sm924) is actually an older, unrelated 2020 action about two Chinese nationals laundering Lazarus-linked funds — the correct March 2026 press release is at a different URL (home.treasury.gov/news/press-releases/sb0230). The claim itself is accurate; the citation is mismatched.
    citedhome.treasury.gov/news/press-releases/sm924www.chainalysis.com/blog/ofac-targets-no…ypto-march-2026/
  23. #29[confirmed][no action needed]in section: Known Infrastructure and Indicators of Compromise
    “Blockchain: Sepolia testnet contract 0x7526aCdCF0B22f9B8F790CF069E5dD16CC414B0e, creator wallet 0x87BF60FB6657d5E5CD425E36FF18aa7Bb5a8FcF4.”
    reviewerSepolia testnet contract 0x7526aCdCF0B22f9B8F790CF069E5dD16CC414B0e and creator wallet 0x87BF60FB6657d5E5CD425E36FF18aa7Bb5a8FcF4 are documented indicators of compromise.Confirmed exactly.
    citedwww.reversinglabs.com/blog/graphalgo-campaign-respawned
  24. #30[confirmed][no action needed]in the timeline
    “2025-04-04”
    reviewerTimeline: Domain veltrixcap[.]org registered on 2025-04-04.Confirmed.
    citedwww.reversinglabs.com/blog/inside-graphalgo
  25. #31[confirmed][no action needed]in the timeline
    “First malicious npm package, graphalgo version 2.2.6, published to the npm registry.”
    reviewerTimeline: First malicious npm package graphalgo v2.2.6 published 2025-05-02.Confirmed.
    citedwww.reversinglabs.com/blog/inside-graphalgo
  26. #32[confirmed][no action needed]in the timeline
    “First malicious PyPI package, graphalgo, published to the Python Package Index.”
    reviewerTimeline: First malicious PyPI package graphalgo published 2025-06-13.Confirmed.
    citedwww.reversinglabs.com/blog/inside-graphalgo
  27. #33[confirmed][no action needed]in the timeline
    “Blocmerce LLC registered as a real Florida LLC with fake CEO 'Alexandre Miller', pre-positioning for the campaign's next persona phase.”
    reviewerTimeline: Blocmerce LLC registered in 2025-08 as a real Florida LLC with fake CEO 'Alexandre Miller'.This timeline entry uses the correct 'Blocmerce' spelling in the event text, unlike the April 2026 entry.
    citedhackread.com/graphalgo-scam-lazarus-hack…us-llcs-malware/
  28. #34[confirmed][no action needed]in the timeline
    “Backup domain veltrixcapital[.]ai registered.”
    reviewerTimeline: Backup domain veltrixcapital[.]ai registered 2025-09-21.Confirmed.
    citedwww.reversinglabs.com/blog/fake-recruite…aign-crypto-devs
  29. #35[confirmed][no action needed]in the timeline
    “'Big'-prefixed npm package wave begins, starting with bignumx and bignum.”
    reviewerTimeline: 'Big'-prefixed npm package wave begins 2025-11-17, starting with bignumx and bignum.Confirmed.
    citedwww.reversinglabs.com/blog/inside-graphalgo
  30. #36[confirmed][no action needed]in the timeline
    “Malicious bigmathutils version 1.1.0 published; package had exceeded 10,000 cumulative downloads. Malicious version subsequently removed and package marked deprecated.”
    reviewerTimeline: Malicious bigmathutils v1.1.0 published 2026-02-11 after exceeding 10,000 cumulative downloads, then removed and deprecated.Confirmed exactly.
    citedwww.reversinglabs.com/blog/fake-recruite…aign-crypto-devs
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.