A developer received a LinkedIn message from a fake recruiter at a crypto startup, who sent a GitHub repo and asked them to 'check out the deprecated Node modules issue.' Using a throwaway VPS and a read-only AI agent, they discovered a backdoor in app/test/index.js — a ~250-line file disguised as a test suite that fetches and executes arbitrary code from a remote server. The trap was triggered automatically via npm's prepare lifecycle script, meaning simply running npm install would execute the payload. The repo's commits were authored under a real developer's stolen identity, and the recruiter's profile was also a stolen identity of a real journalist. The post serves as a warning: these attacks are real, targeted at developers, and easy to fall for on a tired day.
Table of contents
The backdoorHow it triggersA borrowed identityA second borrowed identityThis can happen to anyone339 Impressions1 Comment