Paolo Caversaccio analyzed `1inch-analysis.app`, a malicious macOS bundle sent to 1inch cofounder Anton Bukov by the fake security researcher persona Nick L. Franklin. The source attributes the incident with high confidence to the AppleJeus/Citrine Sleet/UNC4736 DPRK cluster, while noting that the original payload URLs had already been removed. Static analysis found a React Native application that contacted `shelfai.io/api/config`, fetched remote configuration and image resources, wrote files into a temporary path, and executed them through native file utilities. The report documents the bundle structure, file hashes, and ShelfAI-themed masquerade used to deliver the suspected macOS payload.