North Korean Hackers Abuse VS Code Auto-Run Tasks to Deploy StoatWaffle Malware

North Korean threat actors (WaterPlum / Contagious Interview) are distributing a Node.js modular malware called StoatWaffle through malicious VS Code projects, npm packages, and compromised GitHub repositories; the malware includes stealer and RAT modules, uses tasks.json auto-run and multi-stage downloaders, and targets developers and cryptocurrency professionals via sophisticated social-engineering and supply-chain techniques. Vendors have introduced mitigations and law enforcement has pursued related criminal activity.