PolinRider uses fraudulent recruitment and trojanized coding assignments to compromise developers, then hides execution in npm scripts, VS Code tasks, and files presented as fonts. Its loader discovers changing C2 addresses through Ethereum transactions and installs a second stage that modifies development tools for persistence. Additional Node.js and Python components support interactive command execution and collection of browser data, wallets, credentials, environment files, and other developer secrets. Abnormal assesses the samples as associated with DPRK-linked Contagious Interview activity with moderate confidence but did not establish that the analyzed repositories were used in the DPRK-attributed Binance intrusion.