North Korean threat actors published 26 malicious npm packages as part of the StegaBin campaign, a new iteration of the Contagious Interview campaign. The packages masquerade as developer tools and contain install scripts that execute malicious payloads. They use steganography to hide C2 URLs within seemingly innocent Pastebin computer science essays, extracting characters at evenly-spaced positions to decode infrastructure addresses. The malware deploys cross-platform RATs for Windows, macOS, and Linux, with nine modules for VS Code persistence, keylogging, clipboard theft, browser credential harvesting, TruffleHog secret scanning, and Git repository exfiltration. The C2 infrastructure is hosted on Vercel across 31 deployments.