Socket attributes a continuing North Korean Contagious Interview supply-chain campaign to 35 malicious npm packages published across 24 accounts, including six packages that remained live and had more than 4,000 downloads. The packages target developers and job seekers through LinkedIn recruiter lures and coding assignments, pressuring victims to run projects locally and sometimes outside containers while screen-sharing. Their HexEval loader hex-encodes module names and C2 URLs, collects host metadata, posts environment data to Vercel-hosted endpoints, and conditionally retrieves BeaverTail, which can steal browser and cryptocurrency data and pull the InvisibleFerret backdoor. The report also identifies a cross-platform keylogger package and infrastructure such as log-server-lovat.vercel.app, ip-check-server.vercel.app, ip-check-api.vercel.app, and 172.86.80.145:1224, showing an active and adaptive DPRK-linked developer-targeting operation.