DPRK operators are extending their fake-font technique from WOFF and WOFF2 files to TTF and OTF files that actually contain JavaScript. Some newer variants were force-pushed over existing malicious repositories while older fake-font artifacts remained visible in repository history. The continued switching of extensions demonstrates that detections based only on filenames or declared file types are fragile and should be replaced with content- and behavior-based inspection.