A recruiter sent a GitHub repo to 'review.' The npm install was the attack (roman.pt)
Running npm install would have been enough. The package's prepare script auto-runs a file that, buried under walls of commented-out tests, fetches and executes whatever a remote server sends back.
He never cloned it locally. He spun up a throwaway VPS, pointed a read-only AI agent at the tree, and it flagged app/test/index.js almost immediately. The thread's verdict on who's behind it was fast and grim: DPRK.
Sign in to save