ReversingLabs identifies graphalgo, a Lazarus Group fake-recruiter campaign active from May 2025 that targets JavaScript and Python developers with cryptocurrency-themed interview tasks. The operators used social platforms, Reddit and Facebook job posts, a fake Veltrix Capital company, GitHub repositories, and malicious npm and PyPI dependencies to trigger compromise when candidates ran assigned projects. Malicious packages impersonated graphlib and networkx, while bigmathutils built more than 10,000 npm downloads before a later malicious version delivered the same payload chain. The final RAT supported file transfer, process listing, arbitrary command execution, token-protected C2, and MetaMask extension checks, linking the campaign to developer compromise and cryptocurrency theft objectives.