The most dangerous fake job offer a developer can get today ends with a friendly request: clone this repo and run `npm install` before the interview.
Security researchers have tracked this for years. Palo Alto Networks' Unit 42 described a campaign it calls Contagious Interview, active since at least December 2022, where attackers posing as employers convince developers to "download and install an NPM-based package hosted on GitHub" during a fake interview (Unit 42). In March 2026 Microsoft published an updated write-up on the same campaign (Microsoft Security). Remote developers looking for US work are exactly the audience these people want.
Key Takeaways
- Never run a recruiter's code on your main machine. Use a throwaway virtual machine or a cloud dev environment.
- A real employer never asks you to pay for training, equipment, or a "placement fee."
- Payment in crypto, gift cards, or a check you must partly send back is a scam signal, full stop.
- Verify the company and the recruiter through channels you find yourself, not the links they send.
The scam that targets developers specifically
Here's how the malware version usually runs, based on the Unit 42 and Microsoft reports.
A "recruiter," often claiming to hire for a crypto or AI company, reaches out on LinkedIn or a job board. The role pays well and the process moves fast. Then comes a technical step: review this codebase, fix this bug, or run this project before our call. The repo is on GitHub, GitLab, or Bitbucket and looks normal, and that's the point.
In the version Microsoft describes, opening the project in VS Code triggers a prompt to trust the repository author, and if you accept, "Visual Studio Code automatically executes the repository's task configuration file." In other versions, the install step itself pulls down the payload. Either way, the result is a backdoor on your machine. The reports describe theft of crypto wallets and browser-stored data, and once an attacker has a backdoor, the SSH keys and cloud credentials on a developer laptop are in reach too.
Microsoft's advice to organizations applies to you as an individual too: use "a dedicated, isolated environment for coding tests and take-home assignments (for example, a non-persistent virtual machine)," and review any recruiter-provided repository before running scripts or installing dependencies.
My rule is simpler. If I can't verify the company, I don't run their code. If I can, I still run it in a disposable environment.
| Check before you run anything | What to look for |
|---|---|
| `package.json` scripts | `preinstall` or `postinstall` scripts that fetch or run remote code |
| `.vscode/tasks.json` | Tasks set to run on folder open |
| Obfuscated files | Long single-line JS, base64 blobs, code in a "fonts" or "assets" folder |
| Repo history | One commit, brand-new account, no other activity |
| Instructions | "Run this command before our call" with a short deadline |
The classic scams are still everywhere
Not every fake offer is sophisticated. The FTC's job scam guide lists the old patterns: paying upfront for "the promise of a job," fake checks you deposit and then partly send back, and requests to pay with gift cards, wire transfers, or payment apps (FTC).
The numbers are large. In December 2024 the FTC said reported losses to job scams tripled from 2020 to 2023 and passed $220 million in just the first six months of 2024 (FTC). Those figures only count US consumers who filed a report.
For developers, the common variants look like this:
- The equipment scam. You're "hired," then asked to buy a laptop from a specific vendor, to be reimbursed later. The reimbursement never comes.
- The training fee. A "certification" you must pay for before starting.
- The identity grab. They want a photo of your passport, your tax ID, and your bank details before any real interview. That's everything someone needs to open accounts in your name.
- The task scam. Easy online "tasks" for pay, until you have to deposit money to release your earnings. The FTC says reports of these went from zero in 2020 to about 20,000 in the first half of 2024.
How to verify a remote job offer
Do these before you share documents or run anything:
1. Find the company yourself. Search the name, open their real website, and look for the role on their careers page. Don't trust the link in the message.
2. Check the recruiter. A real recruiter has a history: a LinkedIn profile older than a month, connections at the company, an email on the company domain (not Gmail).
3. Ask for a live call with a named person. Scammers avoid video calls or keep the camera off.
4. Watch the timeline. Real hiring has steps. An offer after one chat message, with pressure to decide today, is a warning.
5. Search for complaints. "Company name + scam" takes ten seconds.
Legitimate companies ask for ID and bank details too, but only after a real offer, and usually through a proper payroll or contractor platform. At Ruzora, for example, you apply on a public /jobs page on our own domain, and the process runs through a coding assessment, an AI video interview, and team interviews before any contract paperwork.
A Concrete Version
A composite, based on patterns reported publicly.
Lucas, a Node engineer in Sao Paulo, gets a LinkedIn message: senior role at a "Web3 payments startup," $9,000 a month, fully remote. The recruiter's profile is three weeks old. After one short chat, he's asked to clone a repo and "fix the failing test" before a call tomorrow.
Lucas opens the repo on GitHub in the browser, without cloning. `package.json` has a `postinstall` script that runs a file from a `public/fonts` folder. The file is one long line of obfuscated JavaScript. The company website was registered two months ago and lists no team.
He reports the profile and moves on. Total time spent: 15 minutes. If he'd run `npm install` on his work laptop, the cost could have included his client's AWS keys.
The Honest Counterpoint
Caution has a cost. Plenty of real startups have thin websites, young LinkedIn pages, and founders who recruit from a Gmail address in the first week. If you treat every small company as a scam, you'll miss real jobs.
So scale your checks to the risk. Talking costs nothing. Sharing documents and running code are where the risk is, so that's where to verify. And a real company won't mind you asking for a video call or running their take-home in a VM. If they push back on that, you've learned something.
Frequently Asked Questions
Is it normal for a company to send a repo before the first interview?
It happens, but it's uncommon from legitimate companies before any human conversation. Verify first, and run it in an isolated environment either way.
Should I ever pay anything to get a remote job?
No. The FTC's guidance is direct: don't pay for the promise of a job. That includes placement fees, training, and equipment.
What do I do if I already ran suspicious code?
Disconnect the machine, change passwords from a different device, rotate SSH keys and cloud credentials, move any crypto, and check for unknown logins. If a client's credentials were on that laptop, tell them right away.
The Bottom Line
Don't pay, don't hand over documents before a real offer, and never run an unverified recruiter's code on a machine that matters. A few minutes of checking protects your savings, your identity, and your current clients.
If you want a verified place to start, our open roles are listed here, including Node.js backend and security engineering positions. And if a take-home is next, read how to pass a take-home coding challenge.
Roberto Espinoza is CEO of Ruzora, which places senior LATAM engineers with US startups. Browse open roles.
