A fake recruiter hid a backdoor in a developer interview repo
A recruiter messages a software developer on LinkedIn about a lead-engineer job. She sends a GitHub project and asks him to look at a bug. The moment he sets it up, the project quietly opens a door into his computer for an attacker. This trick targets developers. People posing as startup staff hand over a coding task that secretly installs malware.
Developer Roman Imankulov got one of these messages and took it apart. The "startup" claimed to work in crypto. Instead of running the code on his real machine, he opened it in a safe, walled-off space. A quick read-only scan flagged one odd file at once.
One file gave it away. The trap hid in app/test/index.js, buried inside fake test code. That script builds a web address, reaches out to the server, and runs whatever the server sends back. A developer doesn't even have to run the tests. The code fires on its own.
Roman Imankulov backdoor analysis
Why the setup step is the trap
The attack rides on a normal feature of npm, the tool that developers use to grab code other people wrote. A project can tell npm to run a command the moment you set the project up. So the backdoor fires the second the target types npm install. Why ask about a bug? That request was bait, meant to make him run that exact command.
The attackers faked a trail to look real. The project history used the name of a real engineer, who said he had nothing to do with it. The recruiter photo belonged to a real arts writer with no tech job. When Imankulov said the install failed, the "writer" instantly turned into a Node expert and pushed hard for him to try again. The trick is to make a hostile install feel like routine job paperwork.
