A developer says a supposed recruiter tried to trick him into reviewing a booby-trapped code repository that would have infected his system. The attack used a GitHub-hosted Node.js project whose package.json contained a prepare post-install hook, so running npm install would execute app/test/index.js; that script used an obfuscated URL and remote command execution logic to fetch and run attacker-supplied code.
Why it matters: This is a real-world example of job-lure social engineering aimed at developers, where normal review steps like cloning a repo and installing dependencies can trigger compromise. Developers and employers should treat unsolicited coding tests and recruiter-supplied repositories as high risk, inspect package scripts before running them, and use isolated analysis environments.
2026.06.16
100% relevant
This article establishes a distinct incident: a specific recruiter-lure campaign against a named developer using a malicious repository and npm lifecycle hook, rather than updating one of the already tracked package or repository compromise stories.
2026.06.16
99% relevant
This is the same underlying incident: Python developer Roman Imankulov was approached by a fake recruiter and sent a booby-trapped repository whose package.json prepare hook would execute a backdoor on npm install. The article adds details about the malicious file path (app/test/index.js), the obfuscated server URL, the use of a Hetzner VPS for safe analysis, and that an AI coding agent flagged the backdoor before execution.
← Back to all stories