30,000 Machines Hacked by Fake Job Offers. Mine Was Almost Next.

Bibek Khatri — Tue, 13 Oct 2026 20:43:49 +0000

I got hired without an interview. That alone should have told me everything.

A "recruiter" from a company called Carmlize added me to their Slack workspace. Nobody called me, nobody asked about my experience, and I never spoke to an engineer. The first real message I got was a link to a GitHub repo and a friendly "Here's the technical assessment, clone it and get it running."

I've done enough take-homes to know how hiring usually goes. Companies make you jump through three rounds before they let you near their code. This one skipped straight to "please run our code on your laptop". My gut said no, so I didn't type npm install. I started digging instead.

A few weeks later I read a joint government cybersecurity advisory describing exactly this trick. Fake job interviews had compromised more than 30,000 machines in over 100 countries in about eight months. So yes, the gut feeling was worth listening to.

The numbers made me a little sick

I went looking for how common this is. Short answer: very.

30,000+ devices compromised across 100+ countries between December 2025 and July 2026.
7,000+ crypto wallets hit, with roughly $10.7 million stolen.
338+ malicious npm packages tied to fake-interview lures, downloaded 50,000+ times, found by researchers at Socket since July 2025.
One wave alone in November 2025 added 197 packages and 31,000+ downloads.
Another in June 2025 used 24 different npm accounts to publish 35 packages, and many were pulled before anyone could count them properly.

Every one of those downloads is a developer who thought they were doing a coding test.

First, I tried to find the company

Before I opened a single file, I tried to figure out whether Carmlize was a real business. It didn't go well.

There was a website and a nice pitch about "AI-powered crypto market intelligence". That was about it. No product I could find anyone using, no press, no customers and no history.

Then I looked them up on the UK business registry. The registered address was one of those shared virtual-office addresses that hundreds of unrelated companies use. That's not illegal, and plenty of real startups use them. But it does mean nobody is actually sitting there.

LinkedIn was the part that really bothered me. The people listed as employees each had about one post, thin work histories and almost no activity. It felt like a cast of extras hired to make the company page look busy.

Any one of these on its own, I might have shrugged off. All of them together? I decided to read the code very carefully and run absolutely nothing.

The code looked fine, and that's the scary part

I opened the files in a plain editor without installing anything. Honestly, it looked like a decent project: a Next.js crypto dashboard with live markets, a swap screen, an order matching engine, wallet connect and a small Solidity token contract.

One odd detail: the task brief (FULLSTACK_DEVELOPER.md) says "No Solidity, no RPC work", while the repo is full of exactly that. Sloppy, or a sign the brief was copy-pasted onto bait.

I didn't find anything nasty in the code itself. That's how these attacks are designed. The bad stuff isn't in the repo; it's in what the repo pulls in.

There was an npm token in `.npmrc`

//registry.npmjs.org/:_authToken=<redacted>

I've never seen a legitimate take-home ship an npm credential, and I can't think of a good reason to. With that file in place, npm install logs in to the npm registry as someone else, which lets it download packages the public can't see.

Then there was a Tailwind plugin nobody needs

package.json lists a dev dependency called animatecss-tailwind-adapter, and the Tailwind config loads it:

plugins: [
  require('animatecss-tailwind-adapter')({
    duration: '200ms',
    delay: '1s',
    iterationCount: '4'
  })
],

It sounds harmless. Who'd question an animation helper? So I checked the npm registry metadata (just the metadata; nothing ran).

It was first published on 2026-07-28, and the only version that has ever existed is 2.0.6. A brand-new package starting at version 2 is a classic way to look established.
The maintainer account didn't match the GitHub repo or author name in the package.
It depends on a scoped package called @aaron205whitmore/postcss-animate-utils.

And that package doesn't publicly exist

When I looked up @aaron205whitmore/postcss-animate-utils, the public registry returned a 404. I couldn't see it, download it or read it. You can only get it with the right credentials... like the token sitting in .npmrc.

Put it together and the trap is pretty neat:

You run npm install. npm quietly uses the bundled token.
It downloads the hidden package, and any install scripts in it run straight away.
You run npm run dev. Tailwind loads its config, the config loads the plugin, and the plugin loads the hidden package inside your Node process, with access to everything your user account can touch.

You could read every line of that repo and never find the malware, because it was never in the repo. The repo is just the delivery van.

What they're after

The advisory lists the malware these campaigns use, with names like BeaverTail, InvisibleFerret and OtterCookie. Cute names, ugly jobs. They go after:

your crypto wallets and seed phrases
browser cookies and saved passwords, so they can log in as you
SSH keys, .env files, and GitHub and cloud credentials
a backdoor so they can come back later

The bit that stuck with me: the advisory warns that stolen developer credentials can lead attackers into the developer's employer. If I'd run this on a work laptop, I wouldn't just have been risking my own stuff.

8 signs your take-home might be a trap

These are the things I'll be checking from now on:

You skipped the interview. If you're "hired" or in their Slack before anyone has spoken to you, slow down.
They really want you to run it. A real reviewer cares about your code, not whether you ran theirs.
There are credentials in the repo. .npmrc tokens, real keys in .env files and private registry URLs are all bad news.
A dependency is weirdly new. npm view <pkg> time maintainers repository takes ten seconds and tells you a lot.
Config files load packages. tailwind.config, postcss.config, next.config and vite.config all run code when you build.
There are install scripts. Read every preinstall, postinstall and prepare.
You can't find real people at the company. Virtual-office address, ghost employees, nobody you can actually reach.
The brief and the code disagree. Mine said "no Solidity, no wallet work" and shipped a token contract and wallet integration.

How I'd review one safely next time

Open it in an editor and don't install anything. If you use VS Code, say no when it asks whether you trust the folder, because .vscode tasks can run code too.
Check packages without running them: npm view <pkg> for metadata, npm pack <pkg> to download the tarball and read it.
If you really need to run it, use a throwaway VM or container with no wallets, no SSH keys, no browser logins and no cloud credentials. Delete .npmrc first.
npm install --ignore-scripts helps, but it won't stop a plugin that gets loaded from a config file at build time.

If you've already run something like this

Don't panic, but act quickly and assume the machine is compromised:

Take it off the network.
Using a different, clean device, move any crypto to a brand-new wallet, then change your passwords and rotate your SSH keys, GitHub tokens and cloud keys.
Log out of active sessions everywhere that matters: Google, GitHub, exchanges and email.
Scan the machine, or better, wipe and reinstall it.
Report the npm packages to npm security, and the workspace and recruiter to Slack and LinkedIn.

Trust the weird feeling

What saved me wasn't some clever security tool. It was the feeling that something was off, and twenty minutes of looking around before running anything.

The code in these traps usually looks clean on purpose. The giveaways are everything around it: a company you can't find, employees who barely exist, no interview, and a password nobody should have shipped.

A real employer will happily do a proper interview and won't mind you asking questions before you run their code. If someone's in a hurry for you to run it, that's your answer.

DEV Community: Bibek Khatri