I received so many of these requests to install malware that I removed linkedin from my life completely (besides the scam and spam flood)

Do not install anything on your machine, ever. Tell them politely ~to fuck off~ that you are not interested and move on. I know the desperation to be jobless will obfuscate your mind but again, never ever install anything on your machine when job hunting. I've seen people lose their crypto savings in seconds to say the least.

You've been warned.

These seem like a common pattern lately. I feel for it but again people are creative in making business out of others desperation.

> The code is available on Bitbucket, which IMHO is uncommon

What? There is no world outside github?

The rest of the article is legit, but they had to insert some monopoly worship...

It reads like a true crime story.

Bad actor had prepared the set up so precisely that Claude Code could not detect it.

Malware Bytes? Acronis? There must be some template…

.... Why would you do job interview when they expect you to run some code on your own system, on your own time?

Maybe I work in a different field but last year when I was still looking for jobs, only one company asked for coding assignment and every other company did coding interview which is always browser based editor.

I feel like the industry is mature enough that you can tell a company that sends you a zip file of code to f-off.

I remember reading a similar article here not long ago, and the attack relied on auto-loading in VSCode.

https://opensourcemalware.com/blog/latest-contagious-intervi...

wonder if codex can catch issues ?

> A note on the AI part: Claude Code was not able to detect any strange things when just prompted to scan the code base for unusual patterns.

[flagged]

Slop article. Good for scam awareness I guess, but the main value of the analysis and advice is comedy.

> read process.env directly, which in this app means MONGO_URI, JWT_SECRET, SENDGRID_API_KEY, CLOUDINARY_API_SECRET, PAYTM_MERCHANT_KEY

yeah it can run arbitrary malicious code, but let’s also highlight that it can read the fake app’s own dummy environment variables

> When the victim connects out to […], the server sees the source address on the accepted socket, exactly as any web server sees a visitor’s IP. No discovery, no scanning, no registration of an address. This is precisely why outbound-only design is so convenient for the attacker: it works behind NAT, CGNAT, a corporate proxy, or a home router with zero configuration, and it doesn’t matter if the victim’s IP changes.

huge

> If there is no UI/Desktop environment the module for leaking browser data or screenshots is self-limiting.

yeah this is why a VM is important, it’s because it doesn’t have a UI so screenshots don’t work

> … and reinstall your OS - better safe than sorry.

yeah just for thoroughness’s sake after having a RAT installed (hopefully you didn’t do this step last)