He inspected his take-home coding test with tree -a. It had a hidden .git folder full of malware

The job offer that came with a booby-trapped assignment

A recruiter reached out on LinkedIn with a pitch built for urgency: a Python developer role at a purported Y Combinator startup, remote-first, contract-to-hire, paying "$10,000–15,000 a month." The assignment landed via Google Drive — a zip archive and a PDF describing the task: review and improve the architecture of an existing FastAPI backend. Nothing about the pitch or the packaging looked unusual for a startup hiring process in 2026.

What gave it away was habit, not suspicion. Before opening any unfamiliar codebase, the author runs tree -a to see hidden files — and the assignment repo had a .git folder loaded with pre-configured Git hooks. That's not something a normal project ships with; hooks are local developer tooling, not something you'd bundle into a take-home test for a stranger to receive pre-installed.

Three stages, one commit away from execution

Inside the pre-commit hook was OS-detection logic: the moment a victim ran git commit on the project — the single most natural first action anyone takes on a coding assignment — it would silently identify whether they were on macOS, Linux, or Windows, then curl or wget a remote payload from 45.61.164.38:5777, redirecting all output to /dev/null to leave no trace.

The attack unfolded in three stages. First, the hook pulled down a file named tokenlinux.npl, renamed it to a shell script, and ran it silently in the background with nohup. That script installed Node.js, then fetched a package.json and an obfuscated parser.js. The parser.js file — heavily obfuscated — carried out the actual malicious logic. Reading the dependency list in that package.json told the real story: clipboard access, filesystem operations, cryptographic libraries, and critically, hardhat — an Ethereum smart-contract development environment with no legitimate reason to appear in a backend interview project.

The target wasn't source code or SSH keys. It was crypto wallets and browser extensions.

Not a one-off — a templated operation

The base repository itself wasn't even original: the attackers had simply forked a real, unrelated FastAPI project originally authored by a developer named Bharati Gogoi on GitHub, and grafted their malicious .git folder onto it. Each victim received a payload tagged with a unique id parameter, meaning the campaign was running at scale with per-target customization — not a single hand-crafted lure but an assembly line, with some variants even shipping a .vscode folder configured to trigger infection just from opening the project in VS Code, no commit required.

A quick Nmap scan of the attacker's server turned up something almost incongruous next to the crude social-engineering front end: port 22 was running OpenSSH 9.6p1 on Ubuntu, a recent release with no known exploitable vulnerabilities — evidence of real operational security discipline behind an otherwise unsophisticated delivery mechanism.

On Hacker News, the reaction split between grudging respect and déjà vu. "I assume these types of things are going to become more and more common," wrote one commenter. "Looks like these folks really did their homework. It's nasty, but I have to respect their skills." Another linked a nearly identical campaign that had hit the front page the previous month — fake recruiter, fake take-home, hidden Git hook, remote payload. The pattern isn't new; what's changed is that the interview process itself, the thing every job-seeking developer is primed to trust unquestioningly, is now a viable attack surface at scale.