Microsoft Warns Developers of Fake Next.js Job Repos Delivering In-Memory Malware

A coordinated developer‑targeting campaign uses fake repositories, malicious VS Code tasks, modified JavaScript libraries, and runtime retrieval of attacker-controlled JavaScript (hosted on Vercel, GitHub gists, Google Drive, and other services) to achieve in-memory Node.js execution, profile hosts, exfiltrate environment data, obtain an instanceId for tracking, and deploy a second-stage controller that provides persistent C2 and data‑stealing capabilities; Microsoft, GitLab, Abstract Security, Red Asgard, and others associate these tactics with a North Korea‑linked cluster (Contagious Interview).