--- title: Software Engineer | daily.dev description: A software engineer received a suspicious recruiter outreach offering $10,000–$15,000/month for a Python role. After downloading the take-home assignment, they... canonical: https://daily.dev/posts/software-engineer-vqciwxg4d twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Software Engineer | daily.dev og:description: A software engineer received a suspicious recruiter outreach offering $10,000–$15,000/month for a Python role. After downloading the take-home assignment, they... og:url: https://daily.dev/posts/software-engineer-vqciwxg4d og:image: https://api.daily.dev/og/posts/vqCiWXG4D.png og:image:alt: Software Engineer og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Software Engineer **[Hacker News](https://daily.dev/sources/hn)** · 9 min read · 0 upvotes · 0 comments ## Summary A software engineer received a suspicious recruiter outreach offering $10,000–$15,000/month for a Python role. After downloading the take-home assignment, they ran `tree -a` and discovered pre-configured malicious Git hooks inside the `.git/hooks` directory. The `pre-commit` hook silently fetched and executed a remote payload from a raw IP address, tailored per OS. The multi-stage attack downloaded obfuscated Node.js scripts, installed dependencies including clipboard access and Hardhat (an Ethereum dev tool), suggesting crypto wallet theft as the goal. Unique `id` parameters were used to track individual victims with customized payloads. A variant of the attack also hid malicious VSCode launch commands. The attacker simply cloned a legitimate public FastAPI repo and injected the malicious hidden directory on top of it. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Community take How the wider developer community reacted, aggregated from 2 discussions and 218 comments across lobsters, hackernews (as of 2026-07-28). **TL;DR:** The community is largely engaged and appreciative of this writeup about a fake job interview used to deliver malware via git hooks and VSCode workspace settings, with many sharing their own similar experiences; a notable side-thread debated the author's Harry Potter-themed personal site music. **Sentiment:** 55% positive · 30% mixed · 15% skeptical **The case for** - A commenter revealed they were actually compromised by a similar sophisticated DPRK-linked attack targeting their high-download NPM package, validating the real-world danger. - Several commenters shared practical mitigations: disabling git hooks globally via `git config --global core.hooksPath /dev/null`, using throwaway VMs, and restricting outbound connections. - The article prompted useful discussion about VSCode's workspace trust model and how to harden developer workflows against supply-chain-style attacks. - Many appreciated the author's investigative, CTF-like approach to analyzing the malware. **The pushback** - Claude's AI safety guardrails were criticized as unhelpful to defenders trying to understand malware, while determined attackers have more incentive to bypass them. - VSCode's workspace trust UX was criticized for not clearly communicating that trusting a workspace can auto-execute arbitrary commands. - LinkedIn's lack of meaningful employer verification makes it trivially easy for scammers to impersonate legitimate recruiters. - The author was criticized for not using a VM when running untrusted interview code, calling it 'irresponsible' in the current threat environment. **By community** - lobsters (mixed): Lobsters commenters focused on practical details like the attacker's IP/hosting, technical analysis of the hardhat Ethereum tool's role, and mild criticism of Claude's guardrails, with a generally analytical tone. - hackernews (positive): HN had a large, highly engaged thread praising the writeup, sharing corroborating personal attack stories (including one confirmed DPRK-linked compromise of an NPM maintainer), debating VSCode security UX, and offering concrete defensive advice. **Hottest debate:** Whether VSCode's workspace trust prompt adequately warns users that clicking 'trust' can auto-execute arbitrary scripts, or whether it obscures responsibility behind a vague yes/no dialog. **Open questions** - What exactly does the C2 server protocol look like, and could the malware's victim-to-server communication be exploited back against the attackers? - Is there a way to make git prompt for hook review before execution (like direnv does) rather than requiring users to globally disable hooks? - How can job seekers reliably verify recruiter identity when even legitimate companies use third-party recruiters with no verifiable company email? **Highlights** > Wow, after reading this article, I figured out I was hacked, but with a way more sophisticated attack. A few weeks ago, I had an interview with a CTO of a totally legit company. It was weird because he had disabled the camera, and the person had a strong accent. But everything else sounded like a normal screening interview, and the person definitely knew what he was talking about. At the end of the interview, he explained to me that during the technical interview I would need to make some modifications to their project (it's an OSS product), so he asked me to clone the repo and check the setup. Later, the HR person said the CTO got sick, so the interview would be postponed. But a few days later, the HR profile was deleted from LinkedIn. It was super weird, but it didn't trigger my suspicion until I saw this post on HackNews. I checked, and the repo I was cloning and running during the interview had a malware payload. P.S. I think it was a targeted attack because in the past I maintained a very popular NPM package with 43+M weekly downloads. That's my only explanation for why someone would carry out such a sophisticated social-engineering attack against me. P.P.S. It's great that I have 2FA everywhere, and I always publish NPM packages manually without using tokens. But I need to wipe my laptop and reinstall everything. > — [IvanGoncharov on hackernews · 8 comments](https://news.ycombinator.com/item?id=49014997) > I just checked my calendar, and it was a 45-minute interview scheduled on Calendly. HR person sent me a link to Calendly so I could schedule an interview with the CTO. I actually talked with someone pretending to be the CTO for 45 minutes. I checked other similar threads on HN, but they don't mention an actual Google Meet call with a scammer. > — [IvanGoncharov on hackernews](https://news.ycombinator.com/item?id=49015649) > Posted about this back in May: https://blog.denv.it/posts/i-was-likely-targeted-by-dprk-in-... In my case it was a .vscode hook. Stay safe out there :) > — [denysvitali on hackernews](https://news.ycombinator.com/item?id=49017558) > git config --global core.hooksPath /dev/null Then, in repos you want to turn it on: git config core.hooksPath "$PWD/.git/hooks" This also works on Windows (and presumably other operating systems where /dev/null does not exist) as it seems to be handled as a special-case value. > — [andOlga on hackernews · 1 comments](https://news.ycombinator.com/item?id=49018154) > Claude’s guardrails are incredibly annoying. If you’re actually doing something malicious you have more incentive to figure them out and work around them, but for regular people who want to understand things they go off super easy and there is no incentive to keep trying. > — [dijit on lobsters · 1 points](https://lobste.rs/s/5nhto6/i_inspected_my_take_home_interview#c_zndogt) **Source threads** - [lobsters](https://lobste.rs/s/5nhto6/i_inspected_my_take_home_interview) · 47 points · 6 comments - [hackernews](https://news.ycombinator.com/item?id=49013036) · 359 points · 212 comments ## Similar posts on daily.dev - [I got targeted: Trying to get your credentials via a git post-checkout hook](https://daily.dev/posts/i-got-targeted-trying-to-get-your-credentials-via-a-git-post-checkout-hook-gdmfiqwg0) · Lobsters · 1 upvotes · 0 comments - [A backdoor in a LinkedIn job offer](https://daily.dev/posts/a-backdoor-in-a-linkedin-job-offer-oiqvdnwpw) · Lobsters · 1 upvotes · 1 comments - [How I \(Almost\) Got Hit by a Fake Recruiter Malware Scam — and How Claude Helped Me Catch It](https://daily.dev/posts/how-i-almost-got-hit-by-a-fake-recruiter-malware-scam-and-how-claude-helped-me-catch-it-2iteehrpf) · Medium · 0 upvotes · 0 comments - [Your IDE is an Attack Vector](https://daily.dev/posts/your-ide-is-an-attack-vector-6mrqzzvv0) · DEV · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#python](https://daily.dev/tags/python), [#malware](https://daily.dev/tags/malware), [#git](https://daily.dev/tags/git) [View this post on daily.dev](https://daily.dev/posts/software-engineer-vqciwxg4d) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Software Engineer","url":"https://daily.dev/posts/software-engineer-vqciwxg4d","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/software-engineer-vqciwxg4d"},"datePublished":"2026-07-22T21:47:52.159Z","dateModified":"2026-07-28T15:58:42.425Z","description":"A software engineer received a suspicious recruiter outreach offering $10,000–$15,000/month for a Python role. After downloading the take-home assignment, they...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5544c13688aae7b6fc5a209dab4ad5a8?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5544c13688aae7b6fc5a209dab4ad5a8?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/software-engineer-vqciwxg4d","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,python,malware,git","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"Software Engineer"}]} ```