Socket tracks North Korea’s Contagious Interview operation expanding its npm supply-chain activity with at least 197 additional malicious packages and more than 31,000 downloads, targeting blockchain and Web3 developers through fake interviews and test assignments. Analysis of the malicious tailwind-magic package led to a Vercel staging endpoint, tetrismic[.]vercel[.]app, and the threat actor-controlled GitHub account stardev0914, whose repositories supported loaders, crypto-themed lures, and payload delivery. The attack chain uses npm postinstall execution to fetch JavaScript from Vercel, execute it with eval, and deploy an OtterCookie variant that performs VM checks, host fingerprinting, remote shell access, clipboard theft, keylogging, screenshots, filesystem scanning, and browser and crypto-wallet data collection. The report matters because it shows a reusable GitHub-Vercel-C2 delivery stack and continued weekly npm infiltrations aimed at developer systems and digital-asset theft.