North Korea’s Contagious Interview campaign has added worm-like propagation through poisoned developer repositories, including malicious versions of Next.js projects and Nx plugins, reducing the need for spear-phishing or direct operator contact to initiate infection. Any developer who clones or installs a compromised package can receive a remote access trojan, exposing their workstation, credentials, and connected systems. Organizations with software development pipelines face elevated supply chain risk: a single infected dependency can compromise build environments, source code, and downstream products.