SentinelOne linked an intrusion at an Indian IT services provider to the DPRK-sponsored TraderTraitor group, finding the same FLATROOF and ROOFDECK macOS backdoors previously observed in the LayerZero compromise. Weaponized GitHub coding assignments used malicious Terraform lock files and attacker-controlled provider registries to target developers with valuable cloud and source-control access. The implants collected credentials and host data, used Telegram and Nostr-assisted command-and-control mechanisms, and deployed a stripped third-stage ROOFDECK binary that removed the original payloads. The case shows TraderTraitor expanding beyond cryptocurrency organizations to any developer endpoint capable of providing access to useful infrastructure.