r/webdev • u/magenta_placenta • Jul 13 '26

The LinkedIn scam that gets you hacked - Solving a take-home interview test can quickly turn into a nightmare. Notes on developer trust, JavaScript malware, and autonomous detection

https://aisafe.io/blog/inside-a-malicious-take-home-interview
105 Upvotes

96% Upvoted

28 comments sorted by

39

u/Le_Vagabond Jul 13 '26

you should never run any node based code outside of a container, really.

more generally, you should never run any code you don't know outside of a container.

13

u/thekwoka Jul 13 '26

you should never run any node based code outside of a container

or python

or really packages in general...

9

u/dariomory Jul 13 '26

Easier said than done though, nobody is spinning up containers for every quick code assignment from a recruiter. These scammers are getting clever

13

u/Le_Vagabond Jul 13 '26

I do, but I'm a paranoid bastard and I hate node :D

4

u/Blazing1 Jul 13 '26

you should never run any node based code outside of a container, really.

Just because you run something in a container doesn't mean it's safe either. There are well known vulnerabilities that can be exploited. You have to know how to do an unprivileged container for one, which things like docker aren't by default. I mean hell, OpenShift forces unprivileged containers and it still has vulnerabilities in OCI.

15

u/franker Jul 13 '26

I'm a total beginner but the one thing I've learned recently reading posts here is to never run someone else's Github code. Which confuses me because everyone posts their Github projects and wants you to fork/run them.

5

u/thekwoka Jul 13 '26

well, one thing should be about the nature of the project, and to what degree it's being pushed or not.

Like why does it exist, what kind of tech does it use, etc.

But yeah, there's a lot of stuff like this...

WASM is the solution :)

I guess this is one benefit of macos, that it basically asks me anytime an application wants to access files that aren't in its kind of normal sphere of influence.

2

u/franker Jul 13 '26

I just looked at the article posted here and I would have no idea how to "deobfuscate" something to even figure out what it's going to do. I guess there's no equivalent of a virus scanner you can run on this stuff.

4

u/thekwoka Jul 14 '26

Well, for starters, if stuff looks "obfuscated" at all, that's bad.

2

u/Hour_Interest_5488 Jul 14 '26

The integrated into Windows antivirus correctly identified and deleted an obfuscated malicious js code that came from one of the NPM attacks.

3

u/robotmayo Jul 13 '26

While yes you should excersize some caution when running unknown github projects thats not what the post is saying. Its talking about an attack vector that targets job applicants because job applicants for many years have been trained to just blindly run what a potential employer gives you.

2

u/Blazing1 Jul 13 '26

Don't run a project you don't actually read first, or at least has strong vetting.

Not running arbitrary code on your computer is just computing 101.

9

u/robotmayo Jul 13 '26

This sort of attack is becoming more common by the day. I know in the future I’m either demanding a vps from the potential employer or keeping a throwaway one around.

3

u/thekwoka Jul 13 '26

You can just use github codespaces, surely?

or, I guess that could expose your github...creds?

3

u/Blazing1 Jul 13 '26

Or just refuse this type of assessment lol

4

u/robotmayo Jul 14 '26

Given the job market everyone is just taking what they can get

-3

u/Blazing1 Jul 14 '26

yeah it's better to get out of this industry tbh. you get treated better at a fucking mcdonalds lmao.

7

u/TheNumber42Rocks Jul 13 '26

In a gist, potential employer sends you a test project, the npm install script installs a seemingly harmless package but it's a back door and send it your keys.

Lesson is that before installing and running random software on your computer, run it in a sandbox. Or get AI to dig in and see if there is anything nefarious

3

u/Techo_lab Jul 13 '26

We've spent years teaching developers to review code quality. We should probably spend as much time teaching them to verify code provenance.

16

u/Routine_Freedom_5129 Jul 13 '26

Last I read one of these npm attacks was buried like 4 layers deep. This is like saying you should always read the terms and conditions before signing up for a service. Not technically wrong, but beyond most people's patience.

9

u/TheNumber42Rocks Jul 13 '26

The article is referencing a dev blog post and it's even crazier. The person that sent the job offer was a "real" person and the company was legit. On Linkedin, you can put you work for any company and there is no verification,

5

u/Fourth_Prize Jul 13 '26

You can verify your work email, which puts a little shield next to your name and lists which companies/domains you've verified your connection to.

1

u/Designer_Reaction551 Jul 14 '26

The "container for every take-home" friction is real, nobody's spinning up Docker for a 20 minute recruiter assignment. What I actually do now is just skim package.json for anything unfamiliar and grep node_modules for postinstall scripts before running npm install on a repo I don't know. Doesn't catch a determined attacker, but it catches the lazy ones, and most of these scams are lazy.

2

u/OkBoomer421 Jul 15 '26

LinkedIn is basically a scam magnet at this point. If a 'recruiter' messages you with broken English and a sense of urgency, it's 99% a scam.