Sometimes the job interview just wants to gain code exec on your machine:

codecat@meow.social · runjak.codes/posts/2026-01-21-

@mushu I hate how many inexperienced or unsuspecting devs are gonna fall for this

mushu@social.troll.academy

@morl99 yes, I agree it could be more explicit. That'd also aid with the step of attackers trying to obfuscate the code execution by adding whitespace in the json.

reynir@social.data.coop · runjak.codes/posts/2026-01-21-

@mushu oh no, how rude of them! Thanks for sharing and good luck in your job search!

temptoetiam@eldritch.cafe · runjak.codes/posts/2026-01-21-

@mushu sorry, non techie here: iiuc you detected foul play in the depository. Would it have infected your machine? Done something else?

mushu@social.troll.academy

@temptoetiam hey
yes - I was lucky to detect foul play and happened to be careful.

I found that software would've run that loaded and executed other software. From what I could see the setup in the end was one where my machine would've executed whatever the attackers wanted with user privileges.

I'm not 100% sure what the endgame would've been. Could've gone for ransomware, information stealing, botnets you name it.

gkrnours@mastodon.gamedev.place · runjak.codes/posts/2026-01-21-

@mushu oh yes, putting a lot of whitespace at the start of a command is a classic in roblox malware

mushu@social.troll.academy

@codecat yeah, that's sad indeed.

joshix@fosspri.de

@mushu @morl99 I think IntelliJ also automatically executes stuff when you open a repo

https://www.jetbrains.com/help/idea/project-security.html

temptoetiam@eldritch.cafe

@mushu thank you very much for your kind explanation!

sol_hsa@mastodon.gamedev.place · runjak.codes/posts/2026-01-21-

@mushu Chripes, that sounds like a major misfeature in vscode.

soblow@eldritch.cafe · runjak.codes/posts/2026-01-21-

@mushu That's called dodging a bullet

mushu@social.troll.academy

@sol_hsa yeah - I also think it's bigger than a single editor. Jetbrains does it too: https://www.jetbrains.com/help/idea/project-security.html

Not even starting to think about editors that are more 'AI enabled' ^^

fischkind@chaos.social · runjak.codes/posts/2026-01-21-

@mushu Maybe the real coding challenge was getting their repos deleted and now they'll offer you a job as their head of cyber security?

freya@raru.re · runjak.codes/posts/2026-01-21-

@mushu I hope you find less adversarial prospective employers!

cppguy@infosec.space · runjak.codes/posts/2026-01-21-

@mushu

Something I still don't understand (and didn't understand when I saw @0xabad1dea 's original post): why would crims target out-of-work developers, who are more tech-savvy than most people, probably don't have much money just now, and don't have access to company codebases?

0xabad1dea@infosec.exchange

@CppGuy @mushu most people applying to non-entry-level programming jobs are not out of work, the industry is notorious for requiring job hopping every two years as the only way to get a raise...

additionally, many of these fake job openings are specifically in cryptocoins/gambling/etc and people applying to them are more likely to have random wallet keys lying around.

mushu@social.troll.academy

@freya thanks
If fedi is any measure there are amazing, kind people out there. Some of them even do software.

agitatra@berlin.social · runjak.codes/posts/2026-01-21-

@mushu Did I got it wrong or was this a: "No Backup, No Mercy"-situation? I mean who gives more than strictly limited write access to strangers?
BTW: I got my first it-job as a tester by crashing their system during the interview.

ben@mastodon.lubar.me · runjak.codes/posts/2026-01-21-

@mushu I wonder if anyone has made something that intentionally looks interesting to corporations that might be looking to steal code and ignore its license and added a .vscode/tasks.json that plays a really loud fart sound when executed

zedaardv@mastodon.world · runjak.codes/posts/2026-01-21-

@mushu
Wow, reading these comments made me remember this job I had briefly (over 15 years ago) in Stockholm.

I had a mac laptop, my work laptop was also a mac. And I was working with Postgres.

I had the job for about 2 weeks before they let me go.

I noticed at some point that they had installed a root-kit on my computer.
(the were a sports betting company)

Abspeckgeflüster – Forum für Menschen mit Gewicht(ung)

Sometimes the job interview just wants to gain code exec on your machine: