Fake Coding Test Malware: How to Scan a Recruiter's Repo Before You Open It
A fake coding test from a recruiter can run malware the moment you open the folder or type npm install, before you read a line of the code. Scan the repository first, with a free check.
On October 29, Binance's first public explanation of its $6.4 billion theft was a DevOps engineer's laptop. Nobody outside Binance knows yet how that laptop was compromised, and this post does not claim to. But the FBI has warned for years that the group blamed for large crypto thefts goes after staff with fake recruitment coding tests, and the same route is on record in an earlier exchange theft. A take-home assignment is a repository from a stranger, sent to someone who holds access, and the person is expected to run it.
How a fake coding test runs malware before you read the code
Most developers check a repository by reading the README. The danger sits in files nobody reads. Researchers track fake job interview campaigns by North Korea-linked operators under names such as Contagious Interview, and the common thread is a repository that does something when you open or install it. We have not verified any link between those campaigns and the Binance incident.
The files that run automatically: npm postinstall, VS Code tasks.json and more
A repository can start code without anyone clicking run.
- An npm install hook. A postinstall script in package.json runs on npm install. That is the first command in almost every take-home assignment.
- A VS Code task that runs when the folder opens. A tasks.json file can set runOn to folderOpen, and VS Code runs the task when you open the folder and trust it.
- AI agent and MCP server config. Hook files and server definitions in .claude/settings.json, .cursor and .mcp.json start commands when an AI coding agent opens the folder. So do status line and credential helper commands in the same settings file.
- A dev container command. initializeCommand in devcontainer.json runs on your own machine, outside the container, when you open the folder in a dev container.
- The package manager itself. yarnPath makes yarn run a JavaScript file from the repository as yarn. A .pnpmfile.cjs runs when pnpm resolves dependencies. A binding.gyp with a command expansion runs during the native build that npm starts on its own.
A normal dependency check never reads any of these. It checks what the project asks to install, not what the project does when you open it.
How to scan a recruiter's repository before you open it
Three ways, from least to most effort. None of them runs, installs or fetches anything from the repository.
- Ask the MCP tool. Our public Jeevesus MCP server has a check-repo tool. Send it the few files that matter, package.json, .vscode/tasks.json, .claude/settings.json, .mcp.json, .devcontainer/devcontainer.json, .yarnrc.yml, .npmrc and setup.py, as a map of path to text, up to 40 files and 28,000 characters. No key is needed. Your AI assistant can call it for you if the endpoint is connected as an MCP server.
- Run the command line scanner on an unzipped copy. It reads the directory, never follows symlinks, skips node_modules, stops at fixed limits, and reports every path it skipped as something to look at. Exit code 2 means block, 1 means review, 0 means no findings.
- Let the pull request check do it. The DugganUSA Checks GitHub Action checks pull requests for the same lures. The input is check-repo-lures, on by default, and only what the pull request adds or changes is reported.
The full guide, with every rule and the exact call, is in the repository documentation under "Check a repository before you open it".
What the scan result means
A block means a lure that fetches or evaluates code: a hook that pipes a download into a shell, runs an inline program or decodes base64, a task that does so when the folder opens, a yarnPath. A review means read it before you go further: an unusual install hook, a hook that contacts a URL, a git dependency, a command in a dev container. No findings means none of these patterns were seen. It does not mean the repository is safe.
If you get a block, do not install and do not open the folder in an editor that runs tasks. Read the file on a machine that holds nothing: no credentials, no cloud sessions, no route to anything you own. Then tell the person who sent it, and report the repository to the platform that hosts it.
What we did to make the scanner trustworthy
We pointed the check at our own repository first. It flagged our own agent hooks, which is correct, because they exist. It also flagged two of our detection files because they contain the very signature strings it looks for, which is why a review is a reason to read, not a verdict.
Then we had an independent reviewer try to break it. That review found two real denial-of-service problems, one that took 3.2 seconds on a request-sized input and one that took 174 seconds on a large file; ways to hide a lure by writing JSON keys with escape codes, by using a different folder layout or letter case, or by padding a file; output that could inject terminal or workflow-command text through a hostile dependency name; and about ten lure shapes that came back clean. We fixed them all and added a regression test for each. The slow cases now run in milliseconds.
Limits
This reads a short list of file types with pattern matching. It does not look inside a dependency's code, an image or a binary, and it sees only what you point it at. The MCP tool sees only the files you send. A determined author can hide a lure somewhere not on the list. We report what we skipped. We cannot report what we were never shown. A review finding is a reason to read a file, not proof of anything, and some legitimate projects have install hooks.
It also would not necessarily have stopped what happened at Binance, whose root cause is still unpublished. It targets one documented route: running a stranger's code on a machine that holds access.
Five percent of this is wrong somewhere. It always is.
If this was useful, or was not, rate it at the bottom of the page.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.