I Inspected My Take-Home Interview Project. It Was a Whole Operation
Points and comments are a snapshot, not live.
A take-home interview assignment contained Git hooks that deployed malware to steal cryptocurrency.
A developer accepted a LinkedIn recruiter's take-home test for a $10-15k/month Python role at a Y Combinator startup. Suspicious, he ran `tree -a` and found Git hooks pre-configured to execute remote payloads. The `pre-commit` script downloaded OS-specific malware, which installed Node.js and ran obfuscated code (`parser.js`) using Ethereum development tool Hardhat and clipboard-accessing dependencies to likely drain crypto wallets. The attackers cloned a public FastAPI repo and hid the malicious `.git` hooks. The recruiter deleted their account after being called out.
What commenters are saying
Commenters widely praised the author's thoroughness, comparing the experience to a CTF. Several noted this type of Git hook malware is becoming more common and will increase. A top comment recommended treating recruiter outreach like bank phishing: go through official company channels to validate. Some criticized LinkedIn for not requiring company-email verification for recruiters, though one noted the feature exists but is underused. There was disagreement over whether Claude's refusal to analyze the malware is helpful or overly restrictive.