🚨 SCAM ALERT 🚨 — Developers & Engineers, read this before your next "dream job" reply. A scam is sweeping LinkedIn that specifically hunts technical people. It's organized, convincing, and built to get malware onto YOUR machine. How it works: Someone messages you as a "recruiter" or "Head of HR." The profile looks real — sometimes it's the stolen identity of a real employee. They make you feel wanted — warm questions, flattery, then a salary too good to ignore. Suddenly it feels like the perfect job. They refuse video. Every attempt to move to a call gets dodged. (Reverse variant: they send a "meeting app" to download — that app IS the malware.) They send a "technical assessment" — usually a GitHub repo. "Just clone it, run it locally, share your feedback." THE TRAP: The moment you run npm install, pip install, or start the app, a hidden script executes. These repos bury obfuscated code in config files or in package "postinstall" hooks. It can: drain crypto wallets & browser wallet extensions steal passwords, keychains, session tokens, SSH keys encrypt your files and demand ransom This is a real, organized campaign that has hit developers across tech and crypto. THE TRUTH: No legitimate hiring process asks you to run unknown code on your machine. A real code review happens live — the team shares THEIR screen. You're never asked to execute their project blind. HOW TO PROTECT YOURSELF: Verify the human on the company's OWN site; email them directly to confirm the person exists. New profiles with few connections = red flag. Insist on a video call early. Refusal to ever show their face is a deal-breaker. NEVER run untrusted code on your main machine. Read package.json "scripts" (esp. pre/postinstall) first, and run only inside a throwaway VM or container. Keep crypto off your dev machine — hardware wallet, seed phrase never in plaintext. Slow down. "Dream salary + do it now + run this code" = walk away. IF YOU'VE ALREADY RUN ONE: Disconnect from the internet. From a SEPARATE clean device, move any crypto and rotate every password (email, exchanges, GitHub). Revoke sessions, API & SSH keys; reset 2FA. Run a full malware scan — consider wiping the machine. Recruiters reaching out is normal. But the second one wants you to EXECUTE something, the interview is over. Stay sharp. Share this with your team — one repost could save someone their savings. #CyberSecurity #InfoSec #SoftwareEngineering #ScamAlert #JobSearch #Web3Security
One more piece. I know that lot of people are doing an AI-Run over a project like that to check for safety. Those projects also contain ".claude" ".rules" and different other context injection files. Make sure to remove them from any unknown repo, before starting the scan.
Yep, happened to me twice, fortunately I caught it before real damage was done. One time it was malware hidden in a project that I was supposed to add a feature too as part of interview. It was in linked to `npm install` The second time it was git hooks, connecting to remote server and downloading sh script and trying to run it every time git was called. I noticed a pattern, they typically don't have a listing for the job online. At least not those two. If you look a bit you can find red flags about them. But on surface everything looked legit. Be careful.
Unless things have changed in the 15 months since I left Stripe, you will be asked to clone code from a Github repo during a Stripe technical interview. The critical differences are that you've been in touch with recruiters with email addresses @stripe.com, you're in a Zoom call with an engineer at Stripe (https://stripe.zoom.us/), and the repo is a private one at https://github.com/stripe-interview that will be shared with you at the beginning of the interview. A random repo at a random Github org that sprang into existence a couple of weeks ago is a red flag.
Zain. The “technical assessment” angle is especially dangerous developers naturally trust code repos. Treating unfamiliar code as untrusted by default is a habit worth building.
It happened to me, when i said “i can read to code no need to run it to see results” they insist, so i just wanted to check code, in the api key section i saw a decryption that converts api key to a web url and fetch a second script. Its not only about npm install or prehooks
I have been through the same. It’s becoming increasingly common especially crypto, web3 domains. Everyone should be really cautious about these kind of immediate basis interview completion processes.
Still is a good OpSec practice to segment your activities using different VMs. One for hobby projects, one for work, another for banking or crypto wallets, etc.
This is a critical warning, thank you for laying it out so clearly. The postinstall hook vector is especially nasty because it fires before you ever read a line of the actual app code. My rule as a developer: anything asking me to clone and run goes into a disposable container or VM with no wallet, no SSH keys and no saved credentials, and I read the package.json scripts and lockfile diffs first. A legitimate team is always happy to screen-share their own code instead of asking you to execute theirs blind. Reposting for my network.
If you aren't sure, set up a disposable, sandboxed Linux VM and run the code there.
The mention of postinstall hooks is a critical detail for anyone working with Node or Python environments. It’s a great reminder that even "simple" dependency management can be leveraged to execute arbitrary commands. Using a dedicated, isolated container or VM for any external assessment is a standard safety practice that should be non-negotiable.