Ossprey identified 298 active payload URLs associated with the DPRK's Contagious Interview campaign after malicious npm packages led investigators into a JSONkeeper dead-drop namespace. The operation deployed BeaverTail to steal Chromium credentials, cryptocurrency-wallet data, and password-manager data, while a separate 36-sample Node.js RAT cluster used a port-1244 protocol protected by a `ZT3` handshake. Researchers mapped 26 C2 servers and attributed the distinct RAT to the same operator through converging distribution, obfuscation, port, hosting, and infrastructure evidence. A live `buffer-util-internal` npm dropper showed the operator rotating attacker-controlled payloads in real time on 30 June 2026.