๐๐ผ๐ ๐ ๐๐ฎ๐ธ๐ฒ ๐๐ผ๐ฏ ๐ฅ๐ฒ๐ฝ๐ผ ๐ง๐ฟ๐ถ๐ฒ๐ฑ ๐ง๐ผ ๐ฆ๐๐ฒ๐ฎ๐น ๐ ๐ ๐๐ฒ๐๐
A recruiter sent me a GitHub repo. It looked like a normal coding test. They told me to run npm install. It was a trap.
The repo wanted my wallet keys. It wanted my browser data. They hid malware in the build tools.
Most developers check the source folder. They skip the lockfile. They skip the postinstall script. The attack lives there.
Watch for these red flags:
- postinstall scripts in package.json.
- Obfuscated code in source files.
- Network calls during install.
- Mismatched dependencies in the lockfile.
Stay safe with these steps:
- Turn off install scripts.
- Run npm config set ignore-scripts true.
- Use a VM for untrusted code.
- Read scripts before you run them.
- Compare manifest and lockfiles.
Cloning a repo is safe. Installing runs the code. Treat recruiter repos as hostile.