Posted about this back in May: https://blog.denv.it/posts/i-was-likely-targeted-by-dprk-in-...

In my case it was a .vscode hook. Stay safe out there :)