Phylum reports a renewed August 2024 wave of North Korea-aligned npm activity aimed at developers, with packages including temp-etherscan-api, ethersscan-api, telegram-con, qq-console, helmet-validate, and sass-notification. The qq-console and related packages used multi-stage obfuscated JavaScript to download Python components and a Python interpreter, then searched cryptocurrency wallet browser extensions for sensitive data and established persistence. Helmet-validate contacted ipcheck.cloud, which resolved to the same IP address previously used by mirotalk.net in fake job campaigns tied to North Korean actors. Phylum links qq-console behavior to Contagious Interview and assesses sass-notification as consistent with Moonstone Sleet tradecraft using obfuscated JavaScript, batch and PowerShell scripts, DLL payload execution, and cleanup.