Void Dokkaebi (Famous Chollima) has evolved into a self-propagating supply chain threat targeting software developers by leveraging fake job interview schemes to lure victims into cloning malicious repositories. The infection vector includes malicious Visual Studio Code task configurations that execute automatically upon workspace opening and active injection of obfuscated JavaScript into source code files with Git history tampering to conceal the modifications. This enables worm-like propagation where each compromised developer seeds new infected repositories. The campaign has infected over 750 repositories as of March 2026 and has impacted organizations such as DataStax and Neutralinojs. Payloads are delivered through blockchain infrastructure including Tron, Aptos, and Binance Smart Chain, deploying malware such as DEV#POPPER RAT and other tools aimed at cryptocurrency theft and data exfiltration. The threat is attributed to the WageMole adversary group aligned with North Korea. No patch or official remediation is documented.

The campaign compromises developer machines and software supply chains by injecting malicious code into repositories, enabling widespread propagation and infection of downstream users. It results in unauthorized execution of malware that can steal cryptocurrency and sensitive data. The tampering with Git history complicates detection and remediation. The infection has reached notable organizations, indicating a significant risk to software development environments and supply chain integrity. No known exploits in the wild beyond this campaign are reported, and no official fixes are documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Organizations should exercise caution with unsolicited job interview requests and verify the authenticity of code repositories before cloning. Developers should audit VS Code task configurations and monitor for unauthorized modifications in source code and Git history. Employing repository integrity checks and restricting automatic task executions in development environments may help reduce risk. Since no official patch or fix is available, heightened vigilance and manual detection are critical.