Malicious Composer package - roberts/leads was compromised in the DPRK Famous Chollima / Contagious Interview campaign. Only the dev branch dev-drewroberts/feature/test-case carries a JavaScript loader that fetches encrypted next-stage payloads from TRON/Aptos wallet dead drops via BNB Smart Chain RPC and executes them through eval() in hidden Node.js child processes. Tagged releases unaffected; package removed from Packagist.