From d4d39fc8b48cbb75fc80723bb758bdd848dc97b6 Mon Sep 17 00:00:00 2001
From: S3N4T0R <121706460+S3N4T0R-0X0@users.noreply.github.com>
Date: Sun, 6 Jul 2025 05:15:32 -0400
Subject: [PATCH] Update README.md

---
 North Koreans APT/Famous Chollima/README.md | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/North Koreans APT/Famous Chollima/README.md b/North Koreans APT/Famous Chollima/README.md
index 5fa66a5..4c18276 100644
--- a/North Koreans APT/Famous Chollima/README.md	
+++ b/North Koreans APT/Famous Chollima/README.md	
@@ -53,6 +53,15 @@ However, in some of the repositories created by the attackers, they forgot to di
 
 ## The third stage (implanting technique)
 
+The attackers created an NPM package that, in turn, executes obfuscated JavaScript code, You can use these commands to create the NPM package.json file.
 
+```
+sudo apt-get install npm
 
+mkdir my-malicious-package
+cd my-malicious-package
+npm init -y
+
+```
+![Screenshot From 2025-07-06 05-14-44](https://github.com/user-attachments/assets/750f5360-e40c-4cec-b86c-8d03b388efb8)