A fake recruiter, a crypto repo, and a remote code execution payload hidden in a test file.
  • ivan@piefed.socialEnglish
    23·
    16 hours ago

    Damn, I thought LinkedIn itself got hacked, but that’s just “recruiter” trying to get people to install malicious npm modules. 🥱

    Good heads up tho, I periodically get folks trying some bullshit with me in there like “let’s talk on WhatsApp”.

    • LedgeDrop@lemmy.zipEnglish
      2·
      9 hours ago

      Yikes, this is spooky stuff.

      In the blog post, the author mentioned that their AI agent found the malicious payload.

      That reminded me of people writing malicious AI prompts. I find it shocking , that you really cannot trust 3rd party code and cannot safely use AI as a tool to quickly audit said code.

      I wonder if interviewing will come full circle and we’ll go back to resumes, phone interview, then in-person interviews. Rather, than the whole “take home project” crap (well… at least I have another reason to opt of them).

      • ivan@piefed.socialEnglish
        1·
        8 hours ago

        I think there will be some inventions in regard of “take home projects” like certification of said tasks, secure repositories - things that let you easily check if whatever you just got is legit, or maybe in-browser environments for doing tasks, where it’s all handled on employers servers. Just takes someone to formulate an idea that could be sold and rest is details.

        And as of resumes, phone interviews and in-person interviews - kinda happened already, at least speaking from my engineer’s perspective. Today just hiring someone without in-person interview is a bit foolish due to how easy it is to just open ChatGPT tab or whatever on another screen. And potential engineers then are invited to an in-person interview and fail it miserably after giving somewhat competent answers in online call.

  • incentive@lemmy.mlEnglish
    4·
    13 hours ago

    I just went through this same deal on LinkedIn, only I told the “recruiter” I’d need to verify with the company this is standard practice (which I did, I emailed corporate). The account vanished within a few hours of me sending that msg. Same as the article, I reported the repo to GitHub and as far as I can tell the organization and accounts associated with it are still online.