tetrismic.vercel.app
tetrismic.vercel.app is a domain
that 2 published sources report
in connection with Contagious Interview activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Socket and Red Asgard.
The earliest of those reports is dated 2025-11-26 and the most recent 2026-02-01.
domain Contagious Interview CURATED
Sources
-
Command-and-control or payload-staging host for the October to November 2025 Contagious Interview npm wave; tetrismic.vercel.app is the Vercel-hosted staging endpoint Socket traced to the stardev0914 GitHub account.
Inside the GitHub Infrastructure Powering North Korea's Contagious Interview npm Attacks — Socket -
…the malicious tailwind-magic package highlights a backdoor that, on import, POSTs the local package version to the threat-actor endpoint https://tetrismic.vercel.app/api/ipcheck and eval s the response, granting the threat actor arbitrary code execution with full Node.js process privileges.…
Inside the GitHub Infrastructure Powering North Korea’s Contagious Interview npm Attacks | Socket — Socket -
…everything we documented in the first two parts of this series. OtterCookie: A Second Malware Family Discovery The payload from tetrismic.vercel.app was not BeaverTail.…
Hunting Lazarus Part III: The Infrastructure That Was Too Perfect — Red Asgard
Find this indicator in the index, or see every domain this site holds under Domains in the browse listing.
Related indicators
Cited by the same report: Inside the GitHub Infrastructure Powering North Korea's Contagious Interview npm Attacks
All 398 indicators from this source