TasksJacker DPRK Attack Compromises GitHub Users Via VS Code Tasks

### Executive summary This report analyzes "TasksJacker," an active, sophisticated DPRK-linked supply-chain campaign that injects malicious VS Code task files into hundreds of GitHub repositories to achieve silent code execution when developers open projects; the actors use git history rewriting to hide changes and a resilient multi-blockchain C2 (TRON/Aptos/BSC) to host encrypted payloads, leading to credential and crypto theft, persistence, and downstream upstream PR injection (PolinRider) affecting high-value projects.