content:"Assuming you have stored user information in the request object after authentication" type:code
content:"Assuming you have stored user information in the request object after authentication" type:code is a GitHub search query
that one published source reports
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from DPRK_Dev_Star (@DPRK_Dev_Star).
The report is dated 2025-11-01.
The reporting files it under the persona dantelabservice, alongside 3 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.
github dork IT Worker Fraud RESEARCHER POST
Source
-
Surfaced by DPRK_Dev_Star, an anonymous expose account that narrates in an operator voice to out DPRK developer infrastructure. The first post names the GitHub account adammajoros250 as a source of base64-encoded API keys used to conceal malicious injects in repositories, and gives a GitHub code search that finds the injected pattern. The second presents a fabricated software-company front: the GitHub organization dantelabservice, a repository named Cartid said to hide malicious code, and the site dantelabs.us offered as a way to contact the operators. Both GitHub accounts returned a 404 when checked on 2026-09-11, consistent with removal after the exposure. The handle has no connection to any legitimate business of a similar name; the values recorded here are the specific accounts and domain the researcher cited.
x.com/DPRK_Dev_Star/status/1984576575073816903 — DPRK_Dev_Star (@DPRK_Dev_Star)
Find this indicator in the index, or see every GitHub search query this site holds under GitHub search queries in the browse listing.
Related indicators
Same persona record: dantelabservice
All 3 on the dantelabservice page