DPRK-affiliated Contagious Interview operators used a fake developer recruitment process to pressure a target into opening a malicious GitHub project in VS Code. A hidden folder-open task launched Next.js, whose configuration evaluated a fake jQuery file that retrieved JavaScript from Vercel-hosted staging infrastructure. The resulting Node.js RAT fingerprinted the host, beaconed every five seconds to port 3000, and executed operator-supplied JavaScript from the C2 response. Infrastructure pivots identified seven principal C2 hosts and additional staging endpoints associated with the same tradecraft.