"The tactics, techniques, and procedures (TTPs) observed in this npm attack closely align with Lazarus’s known operations," a cybersecurity research said.