SafeDep uncovered an npm dependency chain in which `ioredis-xyz` silently resolved `redis-type-xyz` and then the malicious `ulid-xyz` package, whose postinstall hook launched a cross-platform remote access trojan. The implant persisted as MicrosoftSystem64 and contacted Hetzner-hosted command servers over port 8010, allowing operators to inspect hosts and deploy additional binaries. SafeDep linked the operation to the DPRK-associated FAMOUS CHOLLIMA cluster through shared implant and persistence characteristics, matching infrastructure patterns, and direct overlap with the previously identified `whisdev` persona. No second-stage payload was recovered, so the report does not establish what was deployed to individual victims.