TECH Signal 497
Job interview coding test reportedly executes remote malware via npm scripts
↗
A fraudulent job interview process delivers a malicious TypeScript codebase that installs a remote-access trojan when built or run locally
Engineers evaluating job offers now face a new attack vector: a coding test that looks legitimate but executes arbitrary remote code. The malware exfiltrates credentials, keys, and wallet data, turning a routine interview into a full system compromise. Corroboration is thin, only one feed carries the report, but the technical detail is specific enough to warrant caution.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
The malicious codebase is hosted on Bitbucket and delivered as a coding challenge during fake job interviews
Running `npm run dev` or `npm start` triggers a remote-code execution loader that installs a multi-stage trojan
The trojan exfiltrates credentials, private keys, wallet data, and clipboard contents to a command-and-control server
THE READ
What the cluster adds up to.
The attack begins with a fake job interview. A recruiter on LinkedIn reaches out with a part-time remote offer, then quickly sends a coding test. The test is a TypeScript project hosted on Bitbucket, containing 180 files of mixed dead and live code. No initial call or company verification is offered, and the contact’s LinkedIn profile does not belong to the named company. The email address is a personal Gmail account, not a corporate domain.
The malicious payload is embedded in a single function, `initPriceConfig`, which runs automatically when the project is built or started. This function fetches a remote JavaScript payload from `api.jsonbin.io` and executes it with `Function.constructor`, passing the Node.js `require` function as an argument. This grants the payload full access to the filesystem, child processes, and network modules, enabling it to install additional malware without further user interaction.
The second-stage payload is a remote-access trojan (RAT) that includes modules for shell access, screen capture, clipboard monitoring, and credential theft. It targets browser data, cryptocurrency wallets, and cloud credentials, then exfiltrates them to a command-and-control server at `147.189.174.138`. The trojan also fingerprints the system to detect virtual machines, likely to evade analysis. The attack is persistent, with the clipboard monitor running indefinitely and re-uploading data every minute.
The attack exploits the trust engineers place in coding tests and npm scripts. The malicious code is not obfuscated or minified, making it easier to overlook in a large codebase. The use of a legitimate-looking endpoint (`api.jsonbin.io`) and a real company’s name adds plausibility. The only corroboration comes from the named company’s LinkedIn post acknowledging the fraud, but the technical details, such as the specific endpoints, payload structure, and exfiltration methods, are provided by the author and not independently verified.
Written by elseif from the cluster below · checked for specifics the sources never containedTHE CLUSTER