The 2017 North Korea test is analyzed together with the previous 2009–2016 tests, and a generalized source model is derived using waveform data. Data are represented by low‐frequency records of 11 broadband near‐regional stations (epicentral distances 140–310 km), bandpassed from 0.03 to 0.09 Hz. The events feature a significant degree of similarity. Therefore, mean records can be calculated by averaging the five tests, using the cross‐correlation shifts and amplitude scaling. The mean records are inverted for the full moment tensor in terms of its posterior probability density function. The mean‐source model reveals significant uncertainties and parameter tradeoffs, due to well‐known resolution problems at shallow depths and long wavelengths. Nevertheless, the moment tensor is undoubtedly dominated by its nonshear parts, that is, the isotropic component, and compensated linear vector dipole (inclined to the vertical). The source type is very close to an opening crack, consistent with existing physical models of explosive shallow sources, accompanied by material damage. The generalized source model presented here is new. It can be used as a prior, realistically constrained model, applicable in early discriminations between natural earthquakes and explosions at the test site. Users at any station (not involved in this study) could precompute template synthetics in their preferred frequency ranges and velocity models. If fitting with real data by a single‐constant source scaling, a real‐time indication of an explosion similar to the previous Democratic People’s Republic of Korea (DPRK) tests can be obtained.