A live operator compromised an instrumented decoy workstation through a trojanized PyPI package and fake coding assignment, producing activity assessed as consistent with the DPRK-linked PolinRider campaign. The operator deployed JavaScript and Python payloads, accessed LSASS, installed Python as SYSTEM, and established three persistence mechanisms disguised as Microsoft .NET optimization components. Collection capabilities included credential, clipboard, screen, source-code, and cryptocurrency-wallet theft, with data exfiltrated to a public IP over port 8443. The lure, tooling, and reused infrastructure linked the intrusion to the wider Contagious Interview and Famous Chollima ecosystem with moderate confidence.