Reversing a DPRK-linked toolkit that backdoors VS Code, Cursor, Discord and npm, with an Ethereum dead-drop C2 and a DEV#POPPER variant https://medium.com/@tarunrd77/north-korea-backdoored-their-vs-code-npm-kept-bringing-it-back-6371da5e74c4?sharedUserId=tarunrd77