DPRK Contagious Interview “Fake Font” Abuses VS Code Tasks

**Executive summary:** OpenSourceMalware describes a Lazarus Group 'Fake Font' supply‑chain campaign that lures developers with fake coding assessments and abuses VS Code .vscode/tasks.json to run JavaScript disguised as .woff2 (BeaverTail), which fetches and executes a highly obfuscated InvisibleFerret Python backdoor designed to steal cryptocurrency, browser credentials, and maintain persistence; the report includes technical TTPs, IOCs (fake Alchemy domain, file paths, headers), analysis of obfuscation techniques, and mitigation guidance.