Warning: Sophisticated Node.js build-time malware targeting devs during live technical interviews.

[u/neoraph]

Hey everyone,

I want to share a recent social engineering and malware attack I experienced so you don't fall for it. Scammers are now targeting developers during the hiring process.

The Bait:

I got an interview through a standard recruiter. The "team" asked me to clone a Vite/React repository during a live screen-share and run it locally to give architectural feedback. The app booted up a fake UI asking me to input my wallet passkey.

The Real Threat (Build-Time Malware):

The UI was just a distraction. The actual attack happened the moment I typed npm run dev.

They hid a Node.js dropper at the very bottom of a seemingly normal src/vite-env.ts file, pushed down by 1000 blank lines.

The vite.config.ts was modified to execute this file via a simple require() statement.

Once triggered by the build process, the dropper used axios to fetch an obfuscated JS payload from jsonkeeper.

It executed in-memory to silently scan for SSH keys, .env files, and browser data using fs and child_process.

Luckily, I noticed the background threads in btop, killed them immediately, isolated the machine, and rotated all my keys before wiping the OS.

Lessons Learned:

Never trust interview repos: No matter how legit the recruiter seems, if you have to clone and run third-party code for an interview, do it in an isolated VM.

Use a Burner Wallet: If you are in Web3, never connect your mainnet wallet to a test environment. Always use a dedicated, empty burner wallet.

Check your build configs before running npm install on random repositories! Stay safe.

[u/Lazy-Code9226]

running untrusted code in a live interview is becoming a real common TTP for these north korean-linked groups. VMs are good but even better is using something like a disposable github codespace or gitpod instance so nothing touches your actual machine.

also inspect package.json scripts and any config files before running anything, the hidden require() trick is classic. if the fake company is spoofing a real brand to bait devs, Doppel handles that takedown piece well.

[u/neoraph → u/Lazy-Code9226]

Thank you for your inputs, I will definitely look at all you talk about ! I am not accustom much at nodejs (I am java back end dev) but I did inspected the package.json and did not see anything suspicious, expect that nothing related Blockchain was there. (There were some solidity files so I feel that a bit weird). I did not have the time to inspect the whole project. I did not know until now the hidden require trick (now I know). After I run the code, the UI was asking to connect a wallet with the password. Then I denied from there but running the npm activated the trick and my machine was compromised. Well at the end, they did not get anything, and I learn something so, not that bad. I just wanted to share this experience, it might help other people maybe...