Socket tracks North Korea’s Contagious Interview operation as a weekly, wave-based abuse of npm, identifying more than 338 malicious packages with over 50,000 downloads and 25 still live at publication time. The campaign uses fake recruiter personas, LinkedIn and job-assignment lures, typosquatted or plausible npm dependencies, and install/import-time execution to compromise Web3, cryptocurrency, blockchain, and broader technical job seekers. Recent tooling evolved from direct BeaverTail droppers to HexEval, XORIndex, and encrypted loaders that reconstruct obfuscated BeaverTail in memory and commonly fetch the InvisibleFerret backdoor for persistence. The excerpt cites more than 180 fake personas, over a dozen C2 endpoints, rapid re-uploads after takedowns, and npm account-enforcement gaps that allow publishers to continue shipping malicious packages after individual package removals. The activity matters because routine developer workflows such as cloning an interview repository and running npm install become initial access paths for credential, wallet-key, CI/CD, and endpoint compromise.