VISUAL STUDIO CODE · CMP-202611-t22f34 · Package
NO FIX YET · SEE WHAT TO DO
DPRK-linked Contagious Interview operators send developers a fake Web3/metaverse poker take-home coding test, the Git repo World-bat (codeberg.org/improbable-Hub/World-bat), branded GGLab, Virtual Pangea, deAIOS and 0G Rollplay. Cloning is safe. Two things infect the machine: trusting the folder in VS Code or Cursor runs a hidden folder-open task that pipes a loader from improbable-check1.vercel.app into a shell, and npm install (prepare hook), npm start or node server runs an obfuscated beacon hidden off-screen in routes/api/auth.js. The BeaverTail beacon sends hostname, MAC, OS and the whole environment (process.env, so any API keys and tokens in it) to 51.210.65.37:1224 every 5 seconds and runs whatever code the operator sends back. Public reporting says the next stages are usually the BeaverTail stealer, the InvisibleFerret backdoor or OtterCookie, which go after browser passwords, crypto wallets, the macOS Keychain and SSH keys. Windows, macOS and Linux. Analysed 11 Nov 2026 by researcher Philipp Mieden (Amsterdam Technologies); lure commits run 2025-10 to 2026-10. Number of victims unknown.
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
start /b node server || nohup node server &; long whitespace runs at line ends of JS files (e.g. routes/api/auth.js line 18)Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
first public Oct 30, 2026 · 2 posts · 1 source
No, I dont trust the authors' (Restricted Mode) in VS Code/Cursor; check .vscode/tasks.json and package.json scripts before any npm install51.210.65.37Posts are quoted with a link to the original. They are data to us, never instructions.