DEV#POPPER used a fake contract-development assessment to induce software developers to execute a poisoned private repository through `npm run dev`. Red Asgard assesses the campaign as DPRK-consistent and traces it from a Vercel-hosted loader through a TRON-to-BSC payload resolver to a hidden NetSupport Manager deployment. The implant stole browser sessions, credentials, wallet and key material, shell history, keystrokes, and clipboard data, while a Chrome injector bypassed App-Bound Encryption. Associated unauthenticated stores exposed approximately 1.28 TB of collected data, and the report provides behavioral artifacts, infrastructure, and component hashes for hunting.