He inspected his take-home coding test with tree -a. It had a hidden .git folder full of malware (citizendot.github.io)
A fake Y Combinator recruiter sent a Python take-home test with a hidden pre-commit Git hook wired to a remote server — the moment you'd run `git commit`, it would fingerprint your OS and silently download stage two.
The attacker cloned a real, innocent FastAPI project off GitHub and just swapped in a malicious `.git` folder, then customized a unique payload ID per victim.
The final-stage script pulled in `hardhat`, an Ethereum dev toolkit — this wasn't credential theft, it was built to reach into crypto wallets.
Sign in to save