An analyst traced a North Korea-linked JavaScript infection chain that modifies VS Code, Cursor, Discord, GitHub Desktop, and the global npm CLI to relaunch an implanted RAT whenever developers use those tools. The payload, assessed as an updated DEV#POPPER variant, uses XOR- and Base64-decoded stages, hides injected code behind padding, and maintains backup copies of altered files. Its socket.io command channel can run shell commands, steal clipboard data and environment variables, upload files and directories, and fetch additional Python payloads in memory. The source identified C2 infrastructure at 193.247.144.38 and documented payload hashes and host artifacts for detection.