SniffDog: I built my job-hunting friend a sniffer dog that sniffs out malware in fake recruiter repos

Anand Prakash Srivastava — Sun, 04 Oct 2026 22:25:22 +0000

This is a submission for the Hacktoberfest Weekend Challenge: Build for a Friend

What I Built

SniffDog checks a take-home coding assignment before you run it. It reads the repo, never executes it, and tells you in plain English whether it's safe to open.

I built it for my friend Mayank Raj. Earlier this year, Mayank, a final-year student hunting for his first developer job, got a LinkedIn message from a "recruiter" offering a remote junior developer role. The recruiter sent a GitHub repo and asked him to open it in VS Code and review the code. On the next call, he was asked to run the project live, so he ran npm install and npm run dev without reading it. Everything worked, and the call went well.

A few days later, he got a "new login" alert on his email and found an unknown session on his GitHub account. Malware had copied his saved browser passwords. He spent the weekend changing passwords, revoking tokens and wiping his laptop. The recruiter's profile was gone.

SniffDog is what I wish he'd had before he opened that folder.

What happened to Mayank wasn't bad luck. Microsoft has tracked the Contagious Interview campaign since at least December 2022: fake recruiters send coding exercises that run malware through dependency installs and repository tasks. In 2026, Elastic Security Labs found the same trick aimed at their own community Slack, with the payload hidden inside SVG images and obfuscated JavaScript. One developer told The Register he was "30 seconds away" from running one.

The trap fires the moment you run npm install, open the folder in VS Code, or start the dev server. A normal AI coding agent asked to "get this running" would do exactly that. SniffDog does the opposite: it looks first.

sniffdog https://github.com/recruiter/assignment \
  --company "Acme Labs" --recruiter "Jane Doe"

You get a verdict (🟢 SAFE, 🟡 CAUTION or 🔴 DANGER) with every red flag tied to a file:line, what it would do if you ran it, and what to do next.

Demo

Narration generated with ElevenLabs. The terminal output in the video is real SniffDog output on the repo's harmless demo assignment.

The repo ships a harmless demo assignment that copies the shape of real attacks: an install script that reaches the internet, a VS Code task that runs on folder open, JavaScript hidden inside a font file, and an obfuscated base64 payload. Every payload only prints "hello". Here is SniffDog reading it (trimmed):

🔴 DANGER
Static checks found 13 suspicious signal(s) in this repository.

Code snippets:
  - lib/config.js:7 (encoded-code) — unwrapped from base64:
    console.log('hello'); /* … */
    Gemma: The code prints 'hello' to the console.
  - package.json:6 (package-script):
    node scripts/setup.js && curl -s https://example.com > /dev/null
    Gemma: The code first executes the `setup.js` script
           using `node`, then fetches data from a URL
           and discards it.
  - public/fonts/inter.woff:1 (disguised-asset):
    console.log('hello from a harmless imitation font');
    Gemma: The code prints the text 'hello from a
           harmless imitation font' to the console.

memory: on
  - resembles known technique: alternate npm registry
  - resembles known technique: disguised font
  - …
tracing: on
Explainer: Gemma (local) read 3 snippets
Static checks only — nothing from the repo was executed.

A clean assignment comes back safe, and the recruiter web check adds context without changing the verdict:

Code

Anand-240 / sniffdog

SniffDog

Review coding assignment repositories before you run them.

Demo video: Watch SniffDog | DEV post: [DEV_POST_URL]

Why this exists

Fake recruiters send take-home repositories that hide malware. Microsoft and Elastic Security Labs have documented this Contagious Interview tactic. A trap may start during npm install, when a folder opens in VS Code, or when the developer starts the app. SniffDog reads the repository before those steps and does not run its code. It was built for a friend who got hit by one of these fake assignments.

What it looks like

The harmless suspicious demo triggers 13 findings, with file locations, rule explanations, and selected code snippets.

The safe demo has zero findings; public recruiter search results appear separately from its verdict.

Quick start

Install Python 3.12 or newer and Ollama on macOS or Linux. Start Ollama, then run:

ollama pull gemma3:1b
ollama pull nomic-embed-text
git clone https://github.com/Anand-240/sniffdog.git

…

View on GitHub

Python 3.12+, standard library only for the core. MongoDB and Sentry are optional extras that switch off cleanly when not configured.

How I Built It

SniffDog is a Python CLI built around one rule: deterministic checks decide how dangerous a repo is; Gemma only reads the code and explains it. The model can never lower the verdict.

repo URL or folder
  → safe clone (no hooks, no symlinks, https only, depth 1)
  → 5 static scanners: scripts · VS Code · obfuscation · assets · deps
  → base64 payloads decoded as data (never run), max 4 KB
  → Gemma 3 (1B, local via Ollama) reads up to 5 snippets
  → MongoDB Atlas: known-technique vector search + history
  → GitHub API + SerpApi: repo age and recruiter context
  → verdict 🟢/🟡/🔴 + next steps
  (every step traced in Sentry, metadata only)

What it catches

The scanners look for the tricks used in real assignment attacks: postinstall scripts that call curl, .vscode/tasks.json with runOn: folderOpen, .woff and .png files that are really JavaScript, code pushed 200 spaces off-screen, _0x obfuscator names, raw-IP URLs, a custom .npmrc registry, and typosquats like expres. Each rule has a hand-written, plain-English consequence ("When you run npm install, packages come from an unknown server…").

Debugging Gemma: from "summarize everything" to "read this code"

My first design asked Gemma to write the whole explanation. It went badly in three useful ways:

It claimed the user's system was "likely compromised", which a static scan can't know. I added a validator that rejects claims of completed harm.
Next it just copied the rule messages back, so it added nothing.
When I gave it only rule names, even gemma3:4b explained hidden code as "may cause rendering issues with extra whitespace". The model wasn't the problem. It had no code to read.

So I changed its job. SniffDog now unwraps the hidden payload itself, statically, and hands Gemma the real snippet. Asked "what would this code do if it ran?", the 1B model is accurate. Every URL it mentions must appear in the snippet, or the sentence is dropped.

Debugging with Sentry

Sentry tracing showed a full scan takes 5.16 s, and the local Gemma call is 3.59 s of it (~70%). That's why Gemma reads at most 5 snippets with a 30 s timeout. The trace also showed the Atlas memory lookup taking 1.52 s, mostly the network round trip, while every local scanner finished in about 1 ms.

Two bugs surfaced along the way:

No traces arrived. The CLI exited before the SDK sent anything. Fix: flush before exit, including on errors.
Too much data. Sentry's debug log showed it auto-enabling its PyMongo and logging integrations, which can record query contents. I turned default integrations off. Traces now carry span names, timings and counts only, and a test proves no code, prompts or finding text leave the machine.

Other lessons

A real company isn't a scam. My first recruiter check flagged "Microsoft" as CAUTION, because the web is full of "Microsoft scam" warnings about impersonators. Now web results only add context ("Scammers have impersonated Microsoft before; verify on the official careers site") and can never change the verdict.
No hiding spots. My coding agent once made the scanner skip a .kilo folder because its own worktree lived there. That's a hole: an attacker could hide a payload in any folder SniffDog ignores. I reverted it. Skipping now needs an explicit --exclude.

Results

Repo	Verdict	Findings
Harmless demo assignment	🔴 DANGER	13 of 13 planted tricks
Safe demo assignment	🟢 SAFE	0
MDN todo-react	🟢 SAFE	0
MDN Express Local Library	🟢 SAFE	0
expressjs/generator	🟡 CAUTION	2 (`child_process` in test files)

I kept the Express Generator result on purpose. Many assignments say "run npm test", so code in test files that starts processes deserves a look. SniffDog has 17 unit tests, and a GitHub Actions workflow runs them plus a SniffDog scan on every PR that touches package files:

Limitations

SniffDog is a first look, not an antivirus. It reads files and matches known patterns, so a new trick can slip past it, and a SAFE verdict is never a guarantee. Package scanners like Socket and Datadog's GuardDog go deeper on npm packages; SniffDog focuses on the whole assignment repo (VS Code tasks, disguised assets, recruiter context) and explains it for someone who has never heard of a postinstall script.

Why Does Open Innovation Matter?

For this tool, a closed cloud model isn't just worse. In the safest setup it can't run at all.

It works where you should test untrusted code. Microsoft's own advice is to do take-home assignments in an isolated, non-persistent VM. The safest version of that VM has no network. A cloud API can't answer there; Gemma on Ollama can. I tested it with Wi-Fi off: same scan, same verdict.
It's free for the people who need it. Mayank is still job hunting. He shouldn't need a paid AI subscription to check whether a recruiter is trying to rob him again. SniffDog runs on my 8 GB MacBook Air with gemma3:1b.
A security tool should be inspectable. Open model, open code, deterministic rules: anyone can read exactly why SniffDog called something dangerous, and change it.
I could change the model's job, not just its prompt. When Gemma struggled, I could swap sizes in seconds (gemma3:4b ran, but froze my laptop and took two minutes), read its raw output, and redesign its role around what a small model does well.

One honest trade-off: the optional GitHub, SerpApi, Atlas and Sentry checks need the network. Everything that touches the code itself works offline.

My Agent Session

I built SniffDog with a coding agent, phase by phase, reviewing every commit and pushing back when it took shortcuts (like the .kilo skip above).

Prize Categories

Best Use of Gemma: gemma3:1b runs locally via Ollama and reads the hidden code SniffDog unwraps, so the explanation works on an offline, isolated machine.
Best Use of MongoDB Atlas: Atlas Vector Search matches suspicious snippets against known attack techniques (local nomic-embed-text embeddings), and Atlas stores scan history so a repeat scan shows "Scanned before on …". No source code is stored.
Best Use of Sentry Agent Tracing: every scan is a transaction with spans per scanner, memory and the Gemma call. Tracing found the CLI exit bug and showed ~70% of scan time is the local model. Metadata only, default integrations off.
Best Use of SerpApi: live web search checks the recruiter and company for impersonation reports, as context that never changes the code verdict.
Best Use of GitHub Copilot: a GitHub Actions workflow runs the tests and a SniffDog scan on every PR that touches package files, failing the check on DANGER.
Best Use of ElevenLabs: the demo video's narration was generated with ElevenLabs.

DEV Community: Anand Prakash Srivastava