Contagious Interview short.gy Links: VS Code and npm Developer Threat Response Guide

According to the 2-spyware.com removal page, the four entries were added between 07:19 and 07:20 UTC. The page says one reporter filed all four within about a minute. All are labeled malware_download and were marked offline in its copy of the data. The tags are:

• js and npm: the code NAZyrea3Bs9iLbd.
• sh and VSCode: the codes ZRsvn1k9l and ZRsvn1k9m.
• bat and VSCode: the code ZRsvn1k9w.

What is and isn't established​

The removal page says it did not download the files, did not infect a test machine, and did not try its cleanup steps on a live infection. Its own check was one plain server request, which returned HTTP 403 with a "Site suspended" page. That response doesn't tell you what the links served earlier. It also doesn't show whether any particular computer was compromised.

So the confirmed facts are the listings, their tags and the offline status. The payload, the target operating systems and the malware family are unverified. Nobody has publicly tied OtterCookie, BeaverTail or any other named family to these four links. The sh, bat and js tags suggest a shell script, a Windows batch file and JavaScript. That is the removal page's reading, not a confirmed analysis.

The parent shortener, short.gy, was registered on January 21, 2021, according to the page's RDAP check. That date says nothing about who created these links or how old the campaign is.

Why the tags matter: the documented campaign​

Microsoft Defender Experts and Microsoft Defender Security Research published an analysis of Contagious Interview on March 11, 2026. They describe a North Korea–attributed campaign in the wider security literature. Microsoft itself calls it a social-engineering operation active since at least December 2022. Its targets are software developers, who are approached through staged recruitment processes. These include recruiter outreach, technical discussions, assignments and follow-ups.

Microsoft describes two delivery routes that match the npm and VSCode tags:

1. npm package. The victim is told to clone and run an npm package from GitHub, GitLab or Bitbucket. Running it loads a follow-on payload.
2. VS Code task. In more recent intrusions, the victim opens the downloaded project in Visual Studio Code and is prompted to trust the repository author. If they agree, VS Code runs the repository's task configuration file. That file fetches and loads a backdoor.

Other researchers describe the same mechanism in more detail. Abstract Security says the runOn value folderOpen in a tasks.json file causes the defined task to execute automatically when a workspace is opened. They also note that task presentation settings can hide the shell activity entirely.

Abstract Security's reporting also touches this shortener directly. It describes tasks.json files in this campaign family that contain short.gy URLs. It reported 22 files containing these shortened URLs at the time of writing. It also saw whitespace padding that pushes the malicious command off-screen. Microsoft's own hunting query for curl or wget piped to a shell includes short.gy and vercel.app as patterns.

That doesn't prove these four links belong to those repositories. It does show that short.gy links in task files are a known pattern, not a coincidence.

What the campaign can do​

Microsoft's findings describe what a successful run can lead to. They are campaign behavior, not an analysis of these four files.

• OtterCookie. Microsoft calls it the most widely observed backdoor in the campaign. It was first seen in September 2024 and grew into a modular JavaScript backdoor that steals data and runs shell commands. A more heavily obfuscated variant has been tracked since October 2025.
• A JavaScript beaconing agent. It has been seen since at least October 2025. It collects host details and can run attacker-supplied code. On Windows, Microsoft says it enumerated environment files, wallet mnemonic phrases, KeePass databases, 1Password artifacts, notes and cryptographic keys. It then sent them out by HTTP POST.
• Spying modules. Microsoft describes keylogging, screenshot capture and clipboard monitoring through Node.js modules and hidden PowerShell commands.
• InvisibleFerret. This is a Python backdoor, now mostly deployed as a follow-on payload after initial access.
• FlexibleFerret. This backdoor is seen less often. It uses a Go or Python implementation, and persistence through Run registry keys.

Microsoft's summary of the impact is that developer endpoints give access to source code, CI/CD pipelines and production infrastructure. The attackers go after API tokens, cloud credentials, signing keys, wallets and password manager artifacts.

Do you need to act?​

The deciding question is whether a device ran the recruiter-provided project, task, script or package that made the request.

If you only saw the name in a firewall, DNS or mail-filter log: that alone doesn't show infection. Work out which device and which process made the request. Then check whether a cloned repository, VS Code task or npm package ran shortly before.

If you ran a recruiter's project, or can't rule it out: treat the machine as potentially compromised.

1. Disconnect the machine from the network. Microsoft's guidance for suspected compromise starts with isolating the device.
2. Work from a separate, trusted device. Change passwords and revoke tokens there, not on the suspect machine.
3. Rotate secrets. That means SSH keys, cloud access keys, GitHub and npm tokens, API keys and anything in .env files. Delete the old ones on the service side.
4. Review access to code repositories and CI/CD systems. Look for recent unfamiliar activity. Microsoft specifically recommends this step.
5. Move cryptocurrency to fresh wallets if seed phrases or wallet files were on the machine. This is a precaution against a possible theft. It isn't proof that these links steal crypto.
6. Scan, then decide on a reinstall. The removal page suggests a Microsoft Defender Offline scan under Windows Security, Virus & threat protection, Scan options. It also suggests a reset via Settings, System, Recovery, Reset this PC with Remove everything if you can't bound the compromise. That ordering is the page's own judgment, not vendor-confirmed. A clean scan can't prove nothing was stolen or that no persistence remains.

If this was a work laptop, tell your security team early. One fake coding test can become a company incident.

Hardening against the next link​

These measures come from Microsoft's mitigation guidance and the sources above.

• Use an isolated environment for take-home tests. Microsoft suggests a non-persistent virtual machine, not a workstation with production credentials.
• Read before you run. Open .vscode/tasks.json in a plain text editor, not in VS Code, and check package.json for install-time scripts. Look for curl, wget, powershell or a shortened URL.
• Be wary of the trust prompt. VS Code's Workspace Trust is the control that matters here. Declining to trust an unknown repository keeps Restricted Mode on.
• Consider turning off automatic tasks. A Security Alliance report suggests setting task.allowAutomaticTasks to off in user settings. It says tasks then won't run on their own regardless of trust. Test this against your own workflow first.
• Hunt for the chain. Microsoft recommends watching for a code editor such as VS Code or Cursor spawning cmd, PowerShell or bash, then curl or wget, then script execution.
• Cut the value of stolen secrets. Use short-lived credentials, store secrets in vaults, and require multifactor authentication and conditional access on source control, CI/CD and cloud consoles.
• Block or alert on shortener redirects in developer tooling. Microsoft lists short-link redirection services among low-reputation hosts used to serve payloads.

Bottom line​

The listings are real and fresh, and the tags line up with a documented attack chain. The payloads and the victims are still unknown. An offline link doesn't mean the problem has gone. Copies of the project can persist on cloned machines, and operators can mint new links on this or another shortener. Treat a recruiter's "quick coding test" as untrusted code, because that is exactly what it is.