How to safely run a take-home coding test (fake recruiter red flags after the Binance case)

Renan Santos — Tue, 03 Nov 2026 22:05:40 +0000

A take-home test is normal. Cloning a stranger's repo and running it on your work laptop should not be.

This week Binance published details of a theft it puts at around $6.3 to $6.4 billion. One step in the chain was a fake job interview. An engineer got a "coding assignment," ran it, and the setup process executed malware.

Here is what happened, and a checklist you can use before your next take-home.

What Binance said happened

According to Binance's Nov. 3 report, as covered by The Hacker News, Security Today and The Washington Post:

In September 2026, an engineer was contacted on a legitimate job platform by someone posing as a Project Director.
There was a first video interview with an "HR representative," who shared a social media account with personal photos to build trust.
A second interview took place on a popular chat app, with someone claiming to be the CEO of a company that did not exist.
Near the end, the engineer was told to download an assignment onto his work computer.
The repository contained code that ran during setup. It swapped a legitimate dev tool component for a poisoned one and talked to an attacker server. Binance said its endpoint tools did not catch it at the time.

That laptop later became a foothold for the rest of the attack. The reports also mention a tampered Homebrew install and abuse of an internal AI tool. The interview was one link, but an important one.

This is not a one-off

Security researchers have documented this pattern for a while.

ReversingLabs describes a campaign it calls "graphalgo," attributed to the Lazarus Group. Fake recruiters reach JavaScript and Python developers on LinkedIn, Facebook and Reddit. The tasks pull in malicious npm and PyPI packages. RL counted 192 malicious packages.

Fireblocks Security Research analyzed fake recruiters impersonating Fireblocks. Victims were told to clone and run a "poker platform" repo. The payload fired on npm start. Other variants used npm install. The malware fetched its next stage from a smart contract, which made it harder to block.

The lesson is simple. The dangerous moment is not reading the code. It is running it.

Red flags in the recruiting process

None of these prove fraud alone. Two or three together should slow you down.

The company is hard to verify. No real website history, no employees you can find, no registration.
The recruiter's profile is new, thin, or reached you first with a very generous offer.
The process moves fast and skips normal steps, like a call with the actual team.
Interviews move to a personal chat app instead of company email or a known video tool.
The "CEO" interviews you early for an individual contributor role.
The test is a full app you must clone and run, not a small focused problem.
They push you to run it now, on your machine, during or right after the call.
The repo is private, shared as a zip, or hosted on an account with no history.
The task is crypto or wallet themed and asks you to connect to a chain or API key.

How to verify the recruiter

Find the company domain yourself. Do not trust links in the message.
Email the recruiter at that domain. Real recruiters have company email.
Check the company careers page for the same role.
Look up the recruiter and interviewers on LinkedIn. Look at account age and real connections.
If they say they work for a big brand, contact that brand through its official site and ask.
Ask for a call on a standard platform with a company calendar invite.

If they get annoyed by basic verification, that tells you something.

Inspect the repo before running anything

Read before you run. Spend 15 minutes here.

Open package.json and look at scripts. Watch preinstall, install, postinstall, prepare, start and test.
Check dependencies you do not recognize. Look them up on npm or PyPI. Very new packages with few downloads are a warning sign.
For Python, read setup.py, pyproject.toml and any requirements.txt pins pointing at odd names or URLs.
Search for obfuscation: long base64 strings, eval, new Function, child_process, exec, curl, wget, powershell.
Search for network calls in config or startup files, including RPC endpoints and contract addresses.
Look at Git history. One giant commit from a fresh account is worth noting.
Check for binaries, minified files in source folders, and files hidden in assets or fonts.

A quick start:

git clone --no-checkout <repo> && cd <repo> && git checkout
cat package.json | grep -A20 '"scripts"'
grep -rnE "eval\(|new Function|child_process|base64|https?://" --exclude-dir=node_modules .

Run it in a disposable environment

If you decide to run it, never use your work laptop or your main machine.

Use a throwaway VM, a cloud dev box, or a container you delete afterward.
Do not mount your home folder or SSH directory into it.
Install with scripts disabled first: npm install --ignore-scripts. Then decide which scripts you actually need.
Limit network access if you can. Watch outbound connections while it runs.
Use a fresh, unprivileged user. No sudo unless the task truly needs it.
Destroy the environment when you are done.

Example with Docker:

docker run --rm -it --network none -v "$PWD":/app -w /app node:22 bash
npm install --ignore-scripts

Turn the network on only when you know why you need it.

No secrets near the test

No real API keys, cloud credentials or wallet keys. Ever.
No browser profile with your logins inside the environment.
No SSH keys, no .npmrc tokens, no GitHub tokens.
If the task needs a key, create a fresh, scoped, disposable one and revoke it afterward.
If a task asks you to connect a real wallet, stop.

If you already ran it

Disconnect the machine from the network.
Tell your security team right away if it was a work device. Speed matters more than embarrassment.
From a clean device, rotate passwords, tokens, SSH keys and session cookies.
Assume browser sessions are stolen and sign out of everything.
Consider a full reinstall of the machine.

For hiring teams

If you send take-homes, make it easy to trust you. Use company email. Keep tasks small. Say clearly that candidates can run them in a container. Avoid install scripts. Candidates now have good reasons to be careful.

A short note on a kit we made

I am turning this checklist into a small kit called the Safe Take-Home Kit. It is a pre-order for US$19 and has not shipped yet. The plan: the fake recruiter checklist, recipes for running a take-home in a container, devcontainer, VM or cloud sandbox, and a repo review prompt for Claude Code or Codex that flags install scripts, obfuscation and odd network calls. It is a convenience, not a guarantee. Everything above is enough to protect yourself for free. Details and refund terms: https://renandlsantos-ai-agent.github.io/safe-take-home/

Stay curious, and stay suspicious of code you did not write.

DEV Community: Renan Santos