7 ms·
> a recruiter at a small crypto startup [...] she described a broken proof-of-concept they needed a lead engineer for, and then sent me a public GitHub repo to
by wxw 4mo ago
> a recruiter at a small crypto startup [...] she described a broken proof-of-concept they needed a lead engineer for, and then sent me a public GitHub repo to review. Specifically, she asked me to “check out the deprecated Node modules issue.”
> ...buried between walls of commented-out tests, the payload runs anything the server sends back to your machine.
> npm runs prepare automatically after npm install, so just installing dependencies executes the backdoor.
> The instruction to “check out the deprecated Node modules issue” was bait to get me to run npm install.
Great catch. I've not been phished on LinkedIn before. Surprised it's getting this bad.
- cyanydeez 4mo agosurprise is unwarranted as linkedin enshittifies. This type of thing is exactly what happens when neither the user of the service, nor the third party commercial interests are being served by the commercial enterprise. It's a vacuum that scams enter into.
- bee_rider 4mo agoLinkedIn is unusually resistant to enshitification; it started that way.
- gleenn 4mo agoFriends don't let friends use NPM. At this point it is so wildly crazy watching people get owned, I don't understand how anyone uses it when they could use e.g. PNMPM and block one if the most obvious and frequently exploited holes. These tools with arbitrary code execution when trying to download some code have got to stop. Edit: typos
- winddude 4mo ago> Friends don't let friends ise NPM or linkedin
- jzig 4mo agoI don't have friends, therefore I must use LinkedIn to get a job. Hooray!
- teiferer 4mo agoI know you are joking, but there is something about this that I really don't get. "Friends" here really means "a professional network". Many nerds despise having one or maintaining/building one. At the same time, people pour weeks/months/years of their life into optimizing their modest investment portfolios. 0.01 percentage points of yearly cost differences of some passive ETF. That surely compounds. But you know what also compounds? Knowing somebody who knows somebody who has $skill or $job_posting. In a big way. Your work comp is still the biggest source of income for most, but investing into optimizing it by broadening your network is something people don't want to do. They'd rather discuss the tax implications of nuances of some investment portfolio.
- philote 4mo agoI don't disagree, but broadening your network is a very different skill (being social) than handling investment portfolios. And for some of us, it's not that we necessarily despise creating or maintaining a network, it's that we suck at it.
- teiferer 4mo agoAnd that's my point. Putting just a little bit of minimal effort pays off much more than micro-optimizing some etf investment. Big time.
- afpx 4mo agoGithub / Microsoft could easily fix this, couldn't they? Leaving NPM up in its current state seems criminal, especially since LLMs generate NPM commands so frequently.
- jjice 4mo agoThey have some changes here in v12: https://github.blog/changelog/2026-06-09-upcoming-breaking-changes-for-npm-v12/ https://github.blog/changelog/2026-06-09-upcoming-breaking-c...
- WalterGR 4mo agoAnd the discussion here, with 215 comments: https://news.ycombinator.com/item?id=48467705 https://news.ycombinator.com/item?id=48467705
- deleted 4mo ago[deleted]
- sheept 4mo agoIs it possible to fix it in a backwards compatible way? Removing lifecycle scripts is at least a semver major change, and would complicate existing projects relying on packages with lifecycle scripts from upgrading.
- evilduck 4mo agoThis is a real world trolley problem scenario. You can break workflows or you can let everyone get pwned by supply chain attacks. Which is the greater harm?
- sheept 4mo agoPeople will not adopt a safer version if it broke their workflows. Adoption is part of preventing supply chain attacks.
- 4mo ago
- deleted 4mo ago[deleted]
- 0x20cowboy 4mo agoI agree, but I’d extend that to any language using a package manager at this point. “A little copying is better than a little dependency” even more correct now. All my current projects have all the code needed in the repo (unless impossible, and aside from a compiler which I guess could also be compromised)
- schrodinger 4mo agoIYKYK
- nijave 4mo ago>These tools with arbitrary code execution when trying to download some code have got to stop But you still end up with the code on your machine and risk it being ran. Bigger issue is giant, inscrutible dependency trees. In this example, if they tried to run the test suite or application, they'd have been in the same boat. Afaik all or most languages have some way to run arbitrary code at install time but it seems node is the main one getting targeted. I think the bigger issue here is just people running untrusted things.
- deleted 4mo ago[deleted]
- gleenn 4mo agoClaude Code regularly installs dependencies using (p)npm after I e.g. pull a company main branch to get in sync with my teammates. That happens often. So I pull, Claude edits some code as you requested and it should pass because Claude did alright, but your local box has out-of-date deps. So then Claude runs (p)npm i and now we have automatic exploitation of this gaping hole in npm given extremely common and current AI tooling. Someone has to figure out how to stop AI from running that command or NPM needs to stop that behavior, and I guarantee you it will be easier to get one tool to change than all AI.
- nijave 4mo agoThe lockfile should protect you there. It'd only be an issue if you're working on updating dependencies in which case there's other protection like min-release-age If pulling down your company repo and running `npm install` can lead to a compromise, something has went terribly wrong with your company's security setup.
- PennRobotics 4mo agoThanks for the reminder. I installed npm yesterday to extract Electron app contents and forgot to remove it afterward.
- burnte 4mo agoI haven't been phished like this but I've certainly had fraudsters try to con me into meetings or schemes, etc.
- pants2 4mo agoLinkedIn offers no way for $company to disavow users who claim to work for $company - they will appear on the official company page as long as it's in their profile. We've had fake recruiters that claim to work for us running basically the same scam. These are great fake profiles: LinkedIn Premium, tons of relevant posts, etc... but they don't work for us, and we get angry messages from people saying our recruiter tried to scam them. No, they're not our recruiter despite showing up on our company page on LinkedIn. No number of reports could get them taken down. I finally got it solved by buying drinks for a buddy of mine that works for LinkedIn, but not all startups have that connection!
- tweetle_beetle 4mo agoLinkedIn didn't even disavow people pretending to work for LinkedIn until someone had too much fun with it - https://chrisduffycomedy.com/blog/2016/11/2/6-months-as-the-ceo-of-linkedin https://chrisduffycomedy.com/blog/2016/11/2/6-months-as-the-...
- rootsudo 4mo agoThat’s funny, thanks for that.
- rendaw 4mo agoWhat happened in the end?
- throwa356262 4mo agoMicrosoft bought LinkedIn. He got a huge package. Everyone lived happily ever after. (LinkedIn eventually locked and then deleted his account, https://awesomeatyourjob.com/1140-bringing-more-laughter-fun-and-connection-to-the-workplace-with-chris-duffy/ https://awesomeatyourjob.com/1140-bringing-more-laughter-fun...)
- sensanaty 4mo agoMy last 2 companies, LinkedIn asked me to add an email address associated with the said company and actually confirm via said email in order to add them to my profile. So, if I worked for FooCompany, I had to have a @FooCompany.com email which is setup by someone at the company itself. Does this not cover what you're talking about?
- mhitza 4mo agoThings like this where a tried and tested method on Upwork, particularly in the 2021-2022 crypto/nft highs. At some point they branched out from crypto projects and cast a wide net across different categories. Last I recall was a download of a windows scr (screensaver masquerading) file. Linkedin is a new low, and I'm sure the platform doesn't really care (look, more jobs), just as ad network companies (Google, Meta) don't really care about scam ads.
- democracy 4mo agoI reported a fake costco website ad (cc harvester) to Google, their response was something along "we cannot verify the ad", go figure
- firefax 4mo agoI've had people phish for my email then hit that with some bullshitpowershellladendoucument.pdf.docx crap, but sending it directly in the IM? Bold strategy cotton, let's see if it pays off.
- citizenpaul 4mo agoI'm not. I call it identitythiefresourcecenter.com or its shorter name freecriminalresource.com I hate how normalized it became for "HR" to require you having a LI page for a job. I don't think its as bad now but for a while it was essentially not possible to get a job without putting all your personal info on linkedin.
- quietsegfault 4mo agoI recently went through an interview—o-thon and got a couple obvious scammers. I hope it’s because it’s more prevalent, and not because I seem stupid enough to fall for it!
- deleted 4mo ago[deleted]
- coip 4mo agoIt’s been this bad for a little while, iirc have seen a few of these pop up over the last few years. And that’s just for the few someone’s caught/documented
- zkmon 4mo agoI stay away anything that needs npm. I regularly scan for node-modules folders and rm -rf it.
- DonHopkins 4mo ago> a recruiter at a small crypto startup That's all you need to know they're criminals and frauds.
- Grimburger 4mo agoI've been freelancing for over a decade. This stuff is every third crypto related job. They're all malware repos running scripts the moment you turn on vscode hoovering up everything they can on your computer. It's the least surprising thing once you've put yourself out there, very strange watching people here think it's novel, I expect it by default at this point, a stranger handing you code needs to go into a vm, would you let them hand you some candy with a wink too?
- red-iron-pine 4mo agowhile working at a Fortune 500 MNC, gig before this one, I used to get LinkedIn hits from recruiters. never got serious ones before, the occasional, useless headhunters who are clearly not based in the same country, but these were different. They were big companies in Canada, ones I'd definitely heard of and even applied to in the past. They were direct, were recruiters for those companies themselves, and were plugged in, able to answer questions, and engaging. they constantly sent job ads, but only via .pdf files. I even pushed back on one and said I don't open random pdfs, send me a link and they declined. Same recruiter hit me up for a similar role a month later, also via pdf. Multiple other members of the IT org, esp. the security and infra teams, also reported similar, aggressive recruitment efforts with pdfs. This was around 2020-2021.