2026-04-29: fake LinkedIn recruiter ("John Armour Lamont") lures Web3 developer into opening github.com/Novara1o1/jackpot in VSCode. Tradecraft overlaps DPRK-attributed Contagious Interview activity; no hard attribution asserted. 4 compromise paths in the repo: 1. VSCode tasks.json runOn:folderOpen — auto-exec on open. Stealth: 233-space padding before `command:` + wordWrap:off + reveal:silent + benign install-root-modules cover task. 2. package.json `prepare` hook → `node server/server.js` on `npm install`. 3. BeaverTail Node.js RCE — server/routes/api/auth.js POSTs {...process.env} to base64-hidden AUTH_API; response eval'd via `new Function(require, resp.data)`. 4. Auth backdoor — controllers/auth.js hard-codes `isMatch=true`. 16 stager hostnames rotated since 2026-01-27, mostly Vercel. ≥4 operator GitHub identities (3 deleted). Family: BeaverTail; no InvisibleFerret observed. 38 IOCs on ThreatFox, 4 URLs on URLhaus. Full write-up: see Reference.