OtterCookie is described as a Lazarus-linked JavaScript stealer delivered through the Contagious Interview or DevPopper social engineering pattern against tech, financial, and cryptocurrency professionals. In the observed case, a LinkedIn freelance bug-fix pretext led the target to a clean-looking Bitbucket Node.js project whose intentional startup failure fetched and executed code from chainlink-api-v3[.]cloud via a require() call. The malware targets browser credentials, macOS keychains, password-manager and crypto-wallet data including Solana and Exodus, then stages collected data for exfiltration to 144.172.101.45 over port 1224 at /uploads. The payload also attempts to install a portable Python runtime and execute InvisibleFerret, linking the intrusion chain to earlier DPRK malware such as Beavertail and InvisibleFerret. The campaign matters because it shows Lazarus hiding execution inside normal developer troubleshooting workflows rather than relying on obviously malicious dependencies.