// HACKER NEWS — CYBERSECURITY
How to compromise your system with a job interview
The current situation on the IT job market is hard. So you are lucky when a recruiter on LinkedIn reaches out to you having a suitable match
for a new position based on your prior experience. It might not be what it seems at a first glance.
“A relevant opportunity” with part-time remote work and a great hourly compensation is what surely pulls a lot of current Software Engineers
into the conversation when a new job offer on LinkedIn comes in - so it happened to a friend of mine.
The job offer was matching very well with the former experience and paired with speeding up the interview process with a quickly sent coding challenge after a couple of messages on LinkedIn.
The initial contact was made in the name of a company that did not know about this. So it is pure phishing just to steal your secrets and credentials. The company is well aware of that and already published a post on LinkedIn explaining the situation.
Before you start with the test, you might be suspicious about the following:
The task is to solve various problems and extend logic in a given TypeScript codebase. The project you receive is
.. but with some calls to external https://api.jsonbin.io endpoints. If you did not read the 180 files of code, you are hooked.
Here is the fishy code part that starts downloading further packages to inspect your system.
That is the endpoint, that ships more garbage. Watch out!
The complete source code can be found in this Bitbucket repository.
The internal logic of the application always runs this function first by executing npm run dev, npm start, and so on. As it hands require in, it can:
A lot of things you desperately do not want to happen on your system.