The Most Targeted Job in the Company

Most security awareness programs quietly exempt the engineering team. Developers are assumed to be too technical to phish, so they get the same annual compliance module as everyone else — or skip it entirely. Attackers have noticed, and they have drawn the opposite conclusion: the people who write, review, and ship code are the most valuable social engineering targets in the building. Sonatype's 2026 State of the Software Supply Chain report counted 454,648 newly discovered malicious open source packages in 2025 alone, against 9.8 trillion component downloads — and nearly every one of those packages exists to trick a developer, not a firewall. With the Verizon DBIR attributing 62% of breaches to the human element, the human element with commit access deserves its own chapter.

Why attackers aim at the people who write the code

An accountant who clicks a phishing link exposes one mailbox. A developer who does the same can expose an organization's source code, its cloud, and — if they maintain anything open source — every downstream company that installs their work. Developer laptops and CI pipelines concentrate exactly what attackers want: long-lived API tokens, cloud keys, signing rights, and publish access to registries that other machines trust automatically.

That asymmetry is why developer-targeted attacks compound. One stolen npm account does not yield one victim; it yields a distribution channel. The modern attacker's insight is that they no longer need to break the build pipeline at all — they can simply ask a developer to run the malware, dressed up as a coding test, a helpful dependency, or an urgent registry email.

Three campaigns, one lesson

The two-year grooming of a maintainer

The XZ Utils backdoor of 2024 remains the most patient social engineering operation on public record. As the reconstructed timeline shows, a persona named "Jia Tan" began submitting small, helpful patches to the widely used compression library in late 2021. Through 2022, accounts that appeared nowhere else online — "Jigar Kumar," "Dennis Ens" — pressured the project's sole volunteer maintainer over slow releases, with lines like "Progress will not happen until there is new maintainer." The maintainer, who had disclosed long-term mental health struggles, gradually handed responsibilities to the one person who seemed to be helping. By 2023 Jia Tan was cutting releases; in February 2024 they merged a backdoor hidden in binary test files, engineered to compromise OpenSSH on much of the world's Linux infrastructure. Only a performance-obsessed Microsoft engineer's last-minute discovery in March 2024 stopped it.

No malware delivered that attack for two and a half years. It was pure social engineering — manufactured pressure, manufactured helpfulness — aimed at a developer's goodwill and burnout.

One phishing email, five hundred packages

September 2025 showed the fast version. Attackers registered the lookalike domain npmjs.help and phished npm maintainers with a credential-update lure. On September 8, a single compromised account let them push malicious versions of foundational packages like chalk and debug — libraries pulled hundreds of millions of times every week — with code that silently swapped cryptocurrency wallet addresses in the browser.

A week later the same ecosystem produced something worse: the Shai-Hulud worm. Malicious package versions ran the open source secret scanner TruffleHog on the victim developer's own machine, harvested npm tokens, GitHub personal access tokens, and cloud keys, exfiltrated them, then used the stolen npm credentials to republish trojanized versions of every package that maintainer owned. GitHub ultimately removed more than 500 compromised packages. One successful phish of one developer had become a self-replicating supply chain event — a supply chain attack that wrote its own sequels.

The recruiter who wants you to run the code

The third campaign skips the maintainer entirely and targets your developers directly. In the "Contagious Interview" operation, North Korean operators pose as recruiters from AI, crypto, and fintech companies, run convincing interview processes, and then ask candidates to complete a technical assessment: clone this project, run it, fix the bug on camera. The project carries malware — loaders and backdoors known as BeaverTail and InvisibleFerret, often tucked inside npm dependencies. A joint advisory from law enforcement and cyber agencies in Japan, the US, Australia, and Germany attributed more than 30,000 infected devices in over 100 countries to the campaign between December 2025 and July 2026, with some $10.71 million in stolen cryptocurrency traced toward Pyongyang. It is the mirror image of the fake IT worker schemes running through the same regime: one infiltrates your hiring pipeline, the other weaponizes your employees' job searches.

Attackers no longer need to break the build pipeline. They ask the developer to run the malware — as a coding test, a convenient dependency, or a helpful patch — and the developer's own privileges do the rest.

The AI layer makes it worse

Two newer dynamics raise the stakes for engineering teams specifically.

AI assistants invent dependencies, and attackers register them. Research presented at USENIX Security 2025 found that code-generating models hallucinated package names in 21.7% of samples for open source models and 5.2% for commercial ones, producing 205,474 unique package names that did not exist — and 58% of those hallucinations recurred when prompts were re-run. A predictable, repeatable fake name is a reservable asset. Slopsquatting — registering those names and waiting — is typosquatting upgraded for the AI era, and it works precisely because the suggestion arrives inside working code from a trusted tool.

Secrets are leaking faster than ever. GitGuardian's State of Secrets Sprawl 2026 counted 28.65 million secrets newly exposed on public GitHub in 2025, up 34% year over year, with leaked credentials for AI services up 81%. In the same vendor telemetry, AI-assisted commits leaked secrets at roughly double the baseline rate of ordinary commits — and when GitGuardian retested credentials first confirmed valid in 2022, well over half still worked years later. Every one of those keys is a free initial access broker for whoever finds it first, and an infostealer on one developer laptop collects them in bulk.

Mapping the developer attack surface

A useful developer awareness program starts by naming the vectors engineers actually face:

Vector	What it looks like	First-line control
Registry account phishing	"Update your 2FA" email from a lookalike domain like npmjs.help	Phishing-resistant MFA on registry and VCS accounts; verify domains character by character
Fake recruiter coding tests	Paid take-home project or live "fix this bug" session that runs malware	Never run interview code outside a disposable sandbox or VM
Malicious and lookalike packages	Typosquatted or dependency-confusion names shadowing internal packages	Lockfiles, internal registry with allowlist, scoped namespaces
AI-hallucinated dependencies	An assistant confidently suggests a package that does not exist — yet	Ten-second registry check on every new dependency: publisher, age, downloads
Secrets in code and history	Keys committed to public repos, surviving for years	Pre-commit scanning, short-lived credentials, blameless revocation drills
Long-game maintainer pressure	Sockpuppets demanding faster releases, offering to "help"	Treat sudden pressure plus sudden helpfulness as a social engineering signature

What developer-focused awareness actually looks like

Segment developers as a distinct risk group. Engineers hold more privilege than almost anyone else in the company, so their risk should be measured, not assumed — track their phishing results, credential hygiene, and reporting behavior as a cohort in your human risk scoring, the way you already do for finance.

Train on their real attack surface. A fake parcel notification teaches a developer nothing. Scenario training built on the cases above — the registry phish, the recruiter with a take-home test, the AI-suggested package — earns attention because it is recognizably about their job.

Simulate what actually arrives. Extend phishing simulations beyond email templates: a lookalike registry security alert, a fake CI failure notification, a GitHub permission request. The September 2025 npm attack was, at bottom, a simulation-sized email that nobody had rehearsed.

Set verification norms and make them cheap. Interview code runs in a sandbox, always. New dependencies get the ten-second check — exists, publisher, age, downloads — especially when an AI suggested them. Out-of-band verification for any recruiter, and for any "maintainer" asking for publish rights.

Harden the accounts that publish. Phishing-resistant MFA on registry, VCS, and CI accounts; scoped and short-lived tokens; trusted publishing where the ecosystem supports it. The Shai-Hulud worm spread on long-lived tokens that one phish could harvest.

Treat secrets hygiene as behavior, not tooling. Scanners find leaked keys; culture determines whether developers rotate them fast and report without fear. A blameless "we found a key, kill it" drill is worth more than a policy document.

The XZ Utils campaign succeeded against a lone, exhausted volunteer because nobody was watching the human layer of the software supply chain. Your engineering organization has advantages he did not — teammates, budget, and the ability to rehearse. The attackers are already treating your developers as the perimeter. The only question is whether your awareness program does too.