--- title: How I (Almost) Got Hit by a Fake Recruiter Malware Scam... description: A developer describes nearly falling victim to a fake recruiter scam where a Web3/crypto-themed GitHub repo was used as bait for a hiring technical test. The... canonical: https://daily.dev/posts/how-i-almost-got-hit-by-a-fake-recruiter-malware-scam-and-how-claude-helped-me-catch-it-2iteehrpf twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How I (Almost) Got Hit by a Fake Recruiter Malware Scam — and How Claude Helped Me Catch It | daily.dev og:description: A developer describes nearly falling victim to a fake recruiter scam where a Web3/crypto-themed GitHub repo was used as bait for a hiring technical test. The... og:url: https://daily.dev/posts/how-i-almost-got-hit-by-a-fake-recruiter-malware-scam-and-how-claude-helped-me-catch-it-2iteehrpf og:image: https://api.daily.dev/og/posts/2itEEhRPF.png og:image:alt: How I (Almost) Got Hit by a Fake Recruiter Malware Scam — and How Claude Helped Me Catch It og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How I (Almost) Got Hit by a Fake Recruiter Malware Scam — and How Claude Helped Me Catch It **[Medium](https://daily.dev/sources/medium_js)** · 5 min read · 0 upvotes · 0 comments ## Summary A developer describes nearly falling victim to a fake recruiter scam where a Web3/crypto-themed GitHub repo was used as bait for a hiring technical test. The recruiter's insistence on installing MetaMask and creating a wallet before touching the code was the first red flag. Rather than running the code locally, the author used Claude to audit the repo inside an isolated sandbox. Two audit passes found nothing suspicious in package.json, dependencies, or main JS files, but a third pass uncovered malware hidden in postcss.config.js, which required an SVG file (public/BJimages/logo.svg) that actually contained base64-encoded JavaScript. That payload executed on build/dev script run, calling out to an attacker-controlled domain and eval-ing whatever code was returned — a live remote-controlled backdoor timed to run while a crypto wallet extension would be installed and unlocked. Key lessons: audit build tool configs, distrust file extensions, treat require()/import of non-code files as suspicious, and never run untrusted 'technical test' code outside an isolated environment. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does the fake recruiter malware scam hide code in a project's build config? The malware is hidden by adding an unused 'logo' property inside an autoprefixer config call in postcss.config.js, which requires a file disguised as an SVG image (public/BJimages/logo.svg). Requiring any file executes it as a Node module, so the SVG's actual base64-encoded JavaScript payload runs automatically the moment npm run dev or npm run build loads the config, before the application even starts. _Developers vetting suspicious coding-test repos can find similar breakdowns and security writeups on daily.dev._ ### Why do fake job recruiters ask candidates to install MetaMask before running a coding test? Scammers insist on installing and unlocking a MetaMask wallet first so that when the hidden malware executes and gains remote code execution on the machine, an unlocked crypto wallet is already present and ready to be drained. The instruction to set up a wallet before touching any project code, repeated without technical justification, is itself a documented scam pattern. _Anyone screening recruiter coding challenges can track scam patterns like this through daily.dev._ ### What does the malicious payload in the rest-icon-handler.store attack actually do once triggered? Once triggered via the require() call in postcss.config.js, the payload runs an async loop that calls out to https://rest-icon-handler.store/icons/103 and executes whatever data that server returns using eval(). Because the remote server controls the returned code, the attacker can change the executed payload at any time without modifying the repository again, making it a live remote-controlled backdoor. _Teams building sandboxed review workflows for untrusted repos can follow related security research on daily.dev._ ## Similar posts on daily.dev - [A backdoor in a LinkedIn job offer](https://daily.dev/posts/a-backdoor-in-a-linkedin-job-offer-oiqvdnwpw) · Lobsters · 1 upvotes · 1 comments - [Fake Claude Code source downloads actually delivered malware](https://daily.dev/posts/fake-claude-code-source-downloads-actually-delivered-malware-5gamzwr6l) · The Register · 1 upvotes · 0 comments - [Can Malware Still Hide Inside Images? What Happened in REF9403](https://daily.dev/posts/can-malware-still-hide-inside-images-what-happened-in-ref9403-ecsqhxika) · Medium · 1 upvotes · 0 comments - [Claude Code Packaging Error Remains a Lure in an Active Campaign: What Defenders Should Do](https://daily.dev/posts/claude-code-packaging-error-remains-a-lure-in-an-active-campaign-what-defenders-should-do-xempao11e) · Trend Micro · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#malware](https://daily.dev/tags/malware), [#claude](https://daily.dev/tags/claude), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/how-i-almost-got-hit-by-a-fake-recruiter-malware-scam-and-how-claude-helped-me-catch-it-2iteehrpf) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How I (Almost) Got Hit by a Fake Recruiter Malware Scam — and How Claude Helped Me Catch It","url":"https://daily.dev/posts/how-i-almost-got-hit-by-a-fake-recruiter-malware-scam-and-how-claude-helped-me-catch-it-2iteehrpf","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-i-almost-got-hit-by-a-fake-recruiter-malware-scam-and-how-claude-helped-me-catch-it-2iteehrpf"},"datePublished":"2026-08-24T09:49:52.844Z","dateModified":"2026-08-24T09:50:59.505Z","description":"A developer describes nearly falling victim to a fake recruiter scam where a Web3/crypto-themed GitHub repo was used as bait for a hiring technical test. The...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d6ab0a9a223ee01bc82d647f54feb2d2?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d6ab0a9a223ee01bc82d647f54feb2d2?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Medium","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Medium","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/medium","url":"https://daily.dev/sources/medium_js"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-i-almost-got-hit-by-a-fake-recruiter-malware-scam-and-how-claude-helped-me-catch-it-2iteehrpf","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,malware,claude,npm","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Medium","item":"https://daily.dev/sources/medium_js"},{"@type":"ListItem","position":3,"name":"How I (Almost) Got Hit by a Fake Recruiter Malware Scam — and How Claude Helped Me Catch It"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-i-almost-got-hit-by-a-fake-recruiter-malware-scam-and-how-claude-helped-me-catch-it-2iteehrpf#faq","mainEntity":[{"@type":"Question","name":"How does the fake recruiter malware scam hide code in a project's build config?","acceptedAnswer":{"@type":"Answer","text":"The malware is hidden by adding an unused 'logo' property inside an autoprefixer config call in postcss.config.js, which requires a file disguised as an SVG image (public/BJimages/logo.svg). Requiring any file executes it as a Node module, so the SVG's actual base64-encoded JavaScript payload runs automatically the moment npm run dev or npm run build loads the config, before the application even starts. Developers vetting suspicious coding-test repos can find similar breakdowns and security writeups on daily.dev."}},{"@type":"Question","name":"Why do fake job recruiters ask candidates to install MetaMask before running a coding test?","acceptedAnswer":{"@type":"Answer","text":"Scammers insist on installing and unlocking a MetaMask wallet first so that when the hidden malware executes and gains remote code execution on the machine, an unlocked crypto wallet is already present and ready to be drained. The instruction to set up a wallet before touching any project code, repeated without technical justification, is itself a documented scam pattern. Anyone screening recruiter coding challenges can track scam patterns like this through daily.dev."}},{"@type":"Question","name":"What does the malicious payload in the rest-icon-handler.store attack actually do once triggered?","acceptedAnswer":{"@type":"Answer","text":"Once triggered via the require() call in postcss.config.js, the payload runs an async loop that calls out to https://rest-icon-handler.store/icons/103 and executes whatever data that server returns using eval(). Because the remote server controls the returned code, the attacker can change the executed payload at any time without modifying the repository again, making it a live remote-controlled backdoor. Teams building sandboxed review workflows for untrusted repos can follow related security research on daily.dev."}}]} ```