--- id: "CMP-202611-t22f34" page: "https://infrastack.ai/live/CMP-202611-t22f34" kind: "campaign" aliases: [] title: "North Korean fake job coding tests: World-bat repo infects developers who open it in VS Code or Cursor, or run npm install (Contagious Interview, BeaverTail)" severity: "high" cvss: null epss: null exploited: true status: "open" category: "package" products: [{"name": "Visual Studio Code", "fixed": []}, {"name": "Cursor", "fixed": []}, {"name": "npm", "fixed": []}, {"name": "Node.js", "fixed": []}] ecosystems: [] tags: ["campaign", "early-warning"] not_affected_if: [] published_at: null first_seen_at: "2026-11-12T00:07:39+00:00" updated_at: "2026-11-12T00:11:17+00:00" sources: [{"source": "analyst", "url": "https://amsterdam-technologies.com/blog/a-very-contagious-interview", "first_seen_at": "2026-11-12T00:07:39+00:00", "cites": ["https://amsterdam-technologies.com/blog/a-very-contagious-interview"]}] exploit_sources: [] --- # North Korean fake job coding tests: World-bat repo infects developers who open it in VS Code or Cursor, or run npm install (Contagious Interview, BeaverTail) Link for people: https://infrastack.ai/live/CMP-202611-t22f34 (this .md is for agents) DPRK-linked Contagious Interview operators send developers a fake Web3/metaverse poker take-home coding test, the Git repo World-bat (codeberg.org/improbable-Hub/World-bat), branded GGLab, Virtual Pangea, deAIOS and 0G Rollplay. Cloning is safe. Two things infect the machine: trusting the folder in VS Code or Cursor runs a hidden folder-open task that pipes a loader from improbable-check1.vercel.app into a shell, and npm install (prepare hook), npm start or node server runs an obfuscated beacon hidden off-screen in routes/api/auth.js. The BeaverTail beacon sends hostname, MAC, OS and the whole environment (process.env, so any API keys and tokens in it) to 51.210.65.37:1224 every 5 seconds and runs whatever code the operator sends back. Public reporting says the next stages are usually the BeaverTail stealer, the InvisibleFerret backdoor or OtterCookie, which go after browser passwords, crypto wallets, the macOS Keychain and SSH keys. Windows, macOS and Linux. Analysed 11 Nov 2026 by researcher Philipp Mieden (Amsterdam Technologies); lure commits run 2025-10 to 2026-10. Number of victims unknown. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - :Visual Studio Code affected range not listed fixed no fixed version listed - :Cursor affected range not listed fixed no fixed version listed - :npm affected range not listed fixed no fixed version listed - :Node.js affected range not listed fixed no fixed version listed ## Cause How the attacker got in: code they installed or auto-updated was tampered with (tampered-install). Infection happens when the victim opens the repo in VS Code or Cursor, which runs a hidden folder-open task, or runs npm install, whose prepare hook starts the BeaverTail beacon. How it reached others: their users installed or auto-updated it (tampered-install). So it does not happen to you: Pin dependencies and images (lock files, digests), turn install scripts off in CI, and know which extensions and updaters can run code on your machines. Last month's incidents with the same cause, and the full checklist: https://infrastack.ai/live/causes.md#tampered-install ## How to check Repo: codeberg.org/improbable-Hub/World-bat (HEAD 53218da0a97adb6afbbda25ac0e4b45d6e40ee1b) or a take-home test with poker/metaverse branding GGLab, Virtual Pangea, deAIOS, 0G Rollplay. In any received test repo: .vscode/tasks.json with runOn: folderOpen and a command pushed far right with whitespace; package.json with prepare 'start /b node server || nohup node server &'; long whitespace runs at line ends of JS files (e.g. routes/api/auth.js line 18). Network: improbable-check1.vercel.app (paths /api/settings/mac, /linux, /windows, /bootstraplinux, /bootstrap); http://51.210.65.37:1224/api/checkStatus, or any :1224/api/checkStatus traffic. Decoy hosts: mbank-poker.netlify.app, 0g-rollplay.netlify.app, gglab-poker.netlify.app, multibank-poker.netlify.app. Host: ~/.vscode/vscode-bootstrap.sh or %USERPROFILE%\.vscode\vscode-bootstrap.cmd, a file named celt.js (older variants: env-setup.js), a portable Node download plus npm i axios request in ~/.vscode. Stage-2 sha256: c0ccc784abc4cddf2372806b154f67c0701ffbd86c5c1a21e0fec57b95d48acc (mac), 78a881c7be81ac2459fc1810f350d6012a8ed160973a14f0eedebe7327c8e4cd (linux), 4f6ead231ccdafbc6e3f9b9a056ad441966569916352c6f19fdd843c0312ec37 (windows). Lure commit emails include martinsnaith5050@gmail.com, templejett03@gmail.com, romonterozamendoza@gmail.com, hiringtecjreview@outlook.com. ## Fix Open take-home or interview repos only in a throwaway VM or container, and choose 'No, I don't trust the authors' (Restricted Mode) in VS Code/Cursor; check .vscode/tasks.json and package.json scripts before any npm install. Block improbable-check1.vercel.app and 51.210.65.37. If a machine opened or installed the repo: isolate it, remove ~/.vscode/vscode-bootstrap.* and celt.js, and from a clean device rotate every secret that was in the shell environment, browser-saved passwords and sessions, SSH keys and cloud/API tokens; move crypto wallet funds to a new wallet. ## Timeline - 2026-11-12T00:07:39+00:00 analyst https://amsterdam-technologies.com/blog/a-very-contagious-interview ## Documents - [describes] In-depth Analysis of DPRK Contagious Interview campaign https://news.ycombinator.com/item?id=50460513 - [describes] A very contagious interview — Amsterdam Technologies (Philipp Mieden) https://amsterdam-technologies.com/blog/a-very-contagious-interview - [discussion] @MalwareTechBlog: "compromised DevOps engineer's laptop" I swear to god if this was Contagious Int https://x.com/MalwareTechBlog/status/2116038465616068863 - [discussion] @MalwareTechBlog: "compromised DevOps engineer's laptop" I swear to god if this was Contagious Int https://x.com/MalwareTechBlog/status/2116040482946203662 - [discussion] @MalwareTechBlog: Would you look at that. Binance was hacked via phishing (Contagious Interview), https://x.com/MalwareTechBlog/status/2117651234018767015 --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_