🚨Recruiter Sends Malicious Take-Home Assignment to Dev
A Python dev got a job test that was actually malware
TL;DR
A recruiter sent a Python developer a take-home assignment that turned out to be malicious. The payload installed Node.js and ran an obfuscated script, potentially stealing crypto wallets or browser extensions. LLMs couldn't deobfuscate the code due to safety concerns.
A recruiter messaged a dev with a Python role at a Y Combinator startup. The take-home assignment was actually malware that installed Node.js and ran an obfuscated script, potentially stealing crypto wallets or browser extensions. LLMs couldn't deobfuscate the code due to safety concerns. The payload hid files in ~/Documents and used unique tracking IDs for each victim.
Key Points
Y Combinator startup offered $10k-$15k/mo for remote-first contract-to-hire role
Take-home test contained FastAPI backend with SQLAlchemy and clean requirements.txt
Script executed a secondary payload named tokenlinux.npl, hiding it as tokenlinux.sh
Parser.js code was heavily obfuscated, changing id parameter returned different scripts
LLMs like Claude refused to analyze parser.js due to safety rails being triggered
Why It Matters
If you're applying for developer roles, especially remote ones, be wary of suspicious take-home assignments. This incident highlights the need for security awareness in hiring processes and underscores the importance of verifying the legitimacy of any code or tools sent by recruiters.
Frequently Asked Questions
Why does this matter?
If you're applying for developer roles, especially remote ones, be wary of suspicious take-home assignments. This incident highlights the need for security awareness in hiring processes and underscores the importance of verifying the legitimacy of any code or tools sent by recruiters.
What happened?
A recruiter sent a Python developer a take-home assignment that turned out to be malicious. The payload installed Node.js and ran an obfuscated script, potentially stealing crypto wallets or browser extensions. LLMs couldn't deobfuscate the code due to safety concerns.
Comments
Be the first to comment
Enjoyed this article?
Get it daily. 7am. Free. Reads in 5 minutes.