Multiple North Korea-aligned threat groups have systematically embedded malware into developer tools, including VS Code extensions, npm packages, and GitHub repositories, to steal cryptocurrency and credentials at industrial scale. Organizations whose developers use these ecosystems face reported financial losses exceeding $12 million and compromise of 26,584 cryptocurrency wallets in Q1 2026 alone, with a single Cursor IDE extension incident resulting in $500,000 in direct losses (per early 2026 threat intelligence reporting). The operation’s ability to reconstitute infrastructure after marketplace takedowns signals a sustained, well-resourced campaign with no near-term end in sight.