ENKI attributes GitHub-hosted malware abusing Visual Studio Code automation features to the DPRK-nexus Contagious Interview campaign targeting developers. Actors posed as recruiters, Web3 developers, and fictitious companies, then embedded OS-specific download commands in .vscode/tasks.json so payloads could execute when victims opened repositories in VS Code. The chain staged BeaverTail, InvisibleFerret, or OtterCookie through C2-hosted scripts, with some malicious commands hidden by whitespace padding and code artifacts suggesting LLM-assisted development. The report lists attacker GitHub personas, suspicious repositories, typosquatted infrastructure such as koinos[.]us, and C2-derived artifacts that help defenders hunt repository-based developer compromise.