GitLab reports that North Korean nation-state actors used GitLab.com in 2025 for Contagious Interview malware distribution and related fake IT-worker operations. The activity targeted software developers, especially in cryptocurrency, finance, real estate, AI, and gaming, with JavaScript projects that commonly delivered BeaverTail and Ottercookie or loaded remote payloads from services such as Vercel. GitLab banned 131 accounts, observed malicious repositories using concealed staging URLs, `.env`-encoded configuration, `Function.constructor` execution, VS Code task abuse, malicious npm dependencies, invite-only private projects, and anti-analysis behavior. The report also describes operational artifacts including a target list of more than 1,000 people, 88 recorded executions of malicious projects, front-company-style email domains, and AI-assisted work on a custom BeaverTail obfuscator.