1614 points•304 comments•0mo ago•by lwhsiao•roman.pt ↗

A backdoor in a LinkedIn job offer

A LinkedIn recruiter asked the author to review a GitHub repo for a crypto startup. In a sandbox, the reviewer found a backdoor in app/test/index.js that can execute server-sent payloads during startup, triggered by npm install via the package.json prepare script. The author reported the repo to GitHub and the recruiter to LinkedIn, noting that impersonated identities were used to lure the reviewer, highlighting social-engineering risks.

Discussion (304)

No comments yet

Top
Trending
New
For You
Bookmarks
Dossier