The Neutralinojs framework was compromised by North Korean (DPRK) threat actors in March 2026 through a sophisticated attack employing stolen GitHub credentials. This breach involved the force-pushing of malicious commits across four separate repositories, which were designed to blend in with the legitimate code history by backdating the timestamps of the commits between 5 to 35 days. This tactic allowed the malicious code to go undetected for approximately three days after its deployment