An investigation into a compromised Web3 and fintech GitHub repository found a malicious VS Code workspace task that invoked Node.js on an embedded WOFF2 file carrying an obfuscated JavaScript loader. The loader used an Ethereum wallet as a dead-drop resolver for rotating C2 IPs and retrieved second-stage payloads from the resulting infrastructure. The author linked the infrastructure and code overlaps to DPRK-linked PolinRider and NullReceiver activity, while noting that the initial repository entry vector was not established.