LinkedIn Take-Home Scam: Hidden Malware

What happened

From a recent security analysis post and a GeekNews writeup, this case is closer to a malware-distribution scheme dressed up as a common job assignment. The offer from LinkedIn looked like a normal software engineer hire, and the repository was styled like a React/Web3-based NFT campaign platform. With demo data and screens in place, it's hard to be suspicious at first glance.

Appearance versus real danger

As in the table below, the attacker uses elements developers routinely see to lower their guard. In particular, the key is hiding malicious logic inside config files and the build flow.

What the attack flow revealed

During analysis, an external IP that appeared to be 45.146.252.17 was confirmed, and there were signs that port 7641 was a Socket.IO–based control channel while 7646 and 7649 were used for file uploads. In other words, this wasn't simple prank code but a structure that had remote control and collection in mind.

The key is one thing. Developers have a habit of installing and running a repository right away when they receive one, and the attacker knows that habit. So you should look at package.json, build scripts, config files, and hidden large blocks before the README.

What to apply immediately in practice

When you receive an unfamiliar assignment repo, it's safer to at least follow the sequence below.

cat package.json
grep -n "preinstall\|postinstall\|prepare" package.json
wc -l tailwind.config.js
wc -c tailwind.config.js

If the wc -l and wc -c results differ excessively, or if you see an obfuscated string at the end of a config file, it's right to stop before installing. If possible, open it first in an isolated VM or container, and separating dependency installation with an option like --ignore-scripts also helps.

Conclusion

This case shows that recruiting scams and malware can combine very naturally. Even if it looks like an ordinary assignment on the surface, executable code is executable code. An unfamiliar repository should start from verification, not trust.

References

• AISafe analysis post
• GeekNews writeup