A Test Assignment with a Surprise: How a Recruiter Sent a Developer Malware in Git Hooks

An engineer named Appaji has described how an ordinary LinkedIn job offer turned into an encounter with a well-thought-out malicious campaign. A recruiter messaged him directly, offering a remote contract position as a Python developer paying $10,000–15,000 a month. The overly generous offer, a salary quoted before any interview, and a mention of a well-known YC startup put the author on guard, but he decided to proceed while staying vigilant.

Hidden in hidden folders

Once his résumé was approved, the applicant was sent a test assignment: a ZIP archive and a fairly convincing PDF with instructions about improving the codebase, making architectural changes and — importantly — carrying out Git operations. The project itself looked like an ordinary backend built on FastAPI and SQLAlchemy, and requirements.txt was clean.

A habit picked up from CTFs saved the day: the author ran tree -a and discovered a set of pre-prepared hooks in the .git/hooks directory. The pre-commit script identified the victim's operating system (macOS, Linux, Windows) and silently downloaded the corresponding payload from a server at a “raw” IP address. Hence the requirement to run Git commands in the assignment — to make sure the hook would fire.

A multi-stage chain

The first script downloaded a secondary payload, disguised it in the ~/Documents directory under the name tokenlinux.sh and launched it in the background via nohup. The next stage quietly installed Node.js, pulled in package.json, parser.js and dependencies, and then ran an obfuscated parser.

The id=402 parameter in the requests, in the author's view, served to assign a unique identifier to each victim — the server handed out different scripts for different IDs. The list of dependencies in package.json gave away the intentions: access to the clipboard (clipboardy), the file system, and also hardhat — a development environment for Ethereum. The author suspects the goal was to find and drain crypto wallets.

Details and irony

An attempt to deobfuscate parser.js with the help of AI produced a curious result: Claude refused to analyze the code — a safeguard kicked in — whereas Gemini happily broke it all down. The .npl extension of the intermediate file pointed to the well-known signature of North Korean groups.

The attack turned out to be widespread: other candidates were sent variants with a .vscode folder, where the commands ran simply when the directory was opened in the editor. The attackers had stolen the original project from an innocent public repository on GitHub. An Nmap scan of their server showed OpenSSH 9.6p1 on a fresh Ubuntu with no known vulnerabilities — the authors were doing better on OPSEC than on disguising the malware itself.

After the author publicly exposed the scheme, the “recruiter's” account vanished. The main takeaway is simple: always check hidden directories before running someone else's code.

Source: Hacker News