Securonix tracks DEV#POPPER as an ongoing social engineering campaign likely tied to North Korean threat actors and aimed at software developers. Attackers pose as interviewers, send GitHub-hosted coding tasks, and rely on the target running a malicious NPM package during the fake interview process. The first-stage JavaScript downloads an archive from 147.124.214[.]131:1244, extracts a hidden Python payload, and runs follow-on Python code that contains hard-coded C2 infrastructure.