Red Asgard maps active Lazarus Group infrastructure discovered while vetting a cryptocurrency Upwork project containing Contagious Interview-style malware. The repository used VS Code auto-execution, a malicious npm dependency, and backend Function.constructor execution to reach Vercel-hosted Stage 1 servers before pulling modular payloads from dedicated C2 hosts. The investigation identifies infrastructure such as task-hrec.vercel.app, kb102531x.vercel.app, brantwork.vercel.app, 147.124.213.232, 147.124.212.125, 216.250.251.87, 66.235.168.238, and 45.59.163.55. Deobfuscation exposed a Python backdoor with Tsunami-style remote access, XMRig mining, scheduled-task persistence, Defender exclusions, Pastebin dead drops, and a custom XOR-encoded binary protocol on Z238. The reporting is significant because it documents both developer-targeted infection vectors and live operator responses such as rate limiting, service shutdowns, and payload rotation.