/dev/aubergine0Jan 25
Fiona

Sometimes the job interview just wants to gain code exec on your machine:

https://runjak.codes/posts/2026-01-21-adversarial-coding-test/

Local girl failed the coding interview:
I don't think they've got a job for me anymore now that I got their repos deleted⁉️

Jan 22 at 9:12amWeb
Show threadFionaJan 22

Thanks to @cxiao for highlighting these:

https://www.jamf.com/blog/threat-actors-expand-abuse-of-visual-studio-code/
https://opensourcemalware.com/blog/contagious-interview-vscode

.. I do know that the version of tokenlinux.sh I retrieved also downloads node and executes something with it.

Threat Actors Expand Abuse of Microsoft Visual Studio Code

Jamf Threat Labs uncovers North Korean hackers exploiting VS Code to deploy backdoor malware via malicious Git repositories in the Contagious Interview campaign

Show threadCindʎ Xiao 🍉Jan 22
@mushu np, glad it didn't get you in this case and thanks for writing it up to warn others!
Show threadCarsten HoffmannJan 22

@mushu that is crazy... thanks for posting about it.

Is it just me, or could the dialog be a little more specific about WHAT it automatically executes? And: why do I want my IDE to automatically execute stuff in a repo I open? What is the positive use case of such a feature? (I am an IntelliJ user, so that is a genuine question)

Show threadFionaJan 22
@morl99 yes, I agree it could be more explicit. That'd also aid with the step of attackers trying to obfuscate the code execution by adding whitespace in the json.
Show threadThomas Guyot-SionnestJan 26
@mushu @morl99 The problem is that it could give a false sense security. I'm not super familiar with vscode but I bet there are dozens ways of exploiting this, many of which are yet to be known. Blocking it all at once is the safe thing to do.
Show threadJoshixJan 22

@mushu @morl99 I think IntelliJ also automatically executes stuff when you open a repo

https://www.jetbrains.com/help/idea/project-security.html

Project security | IntelliJ IDEA

IntelliJ IDEA Help
Show threadCarsten HoffmannJan 22

@joshix @mushu interesting, I have never felt the need for this: https://www.jetbrains.com/help/idea/settings-tools-startup-tasks.html

Maybe something for other ecosystems...

Startup Tasks | IntelliJ IDEA

IntelliJ IDEA Help
Show threadMelissa ​Jan 22
@mushu I hate how many inexperienced or unsuspecting devs are gonna fall for this :(
Show threadFionaJan 22
@codecat yeah, that's sad indeed.
Show threadAbieJan 22
@mushu sorry, non techie here: iiuc you detected foul play in the depository. Would it have infected your machine? Done something else?
Show threadFionaJan 22

@temptoetiam hey :)
yes - I was lucky to detect foul play and happened to be careful.

I found that software would've run that loaded and executed other software. From what I could see the setup in the end was one where my machine would've executed whatever the attackers wanted with user privileges.

I'm not 100% sure what the endgame would've been. Could've gone for ransomware, information stealing, botnets you name it.

Show threadAbieJan 22
@mushu thank you very much for your kind explanation!
Show threadgkrnoursJan 22
@mushu oh yes, putting a lot of whitespace at the start of a command is a classic in roblox malware
Show threadJari Komppa 🇫🇮Jan 22
@mushu Chripes, that sounds like a major misfeature in vscode.
Show threadFionaJan 22

@sol_hsa yeah - I also think it's bigger than a single editor. Jetbrains does it too: https://www.jetbrains.com/help/idea/project-security.html

Not even starting to think about editors that are more 'AI enabled' ^^

Project security | IntelliJ IDEA

IntelliJ IDEA Help
Show threadSoblow Xaselgio Jan 22
@mushu That's called dodging a bullet 
Show threadsvøJan 22
@mushu Maybe the real coding challenge was getting their repos deleted and now they'll offer you a job as their head of cyber security? 🤔
Show threadFreya ArsonJan 22
@mushu I hope you find less adversarial prospective employers!
Show threadFionaJan 22
@freya thanks 💖
If fedi is any measure there are amazing, kind people out there. Some of them even do software.
Show threadAgitatra 🚲🐻🌿🇪🇺🇺🇦Jan 22
@mushu Did I got it wrong or was this a: "No Backup, No Mercy"-situation? I mean who gives more than strictly limited write access to strangers?
BTW: I got my first it-job as a tester by crashing their system during the interview.
Show threadzedaardvJan 22

@mushu
Wow, reading these comments made me remember this job I had briefly (over 15 years ago) in Stockholm.

I had a mac laptop, my work laptop was also a mac. And I was working with Postgres.

I had the job for about 2 weeks before they let me go.

I noticed at some point that they had installed a root-kit on my computer.
(the were a sports betting company)

Show threadFionaJan 22

@zedaardv outch - sorry to hear that 🫤

I mean there are some cases where device surveillance makes sense from a compliance perspective, but it should never be a surprise and be clearly documented upfront.

Show threadzedaardvJan 23

@mushu Yeah, it was a weird place.

They wouldn't tell me what they wanted me to do, then got mad at me when I didn't do it.

Like I was supposed to be a mind reader.

Show threadZ̈oéJan 22
@mushu I wonder what the payload script contained
Show threadFionaJan 22
@uint8_t might've been this: https://social.troll.academy/@mushu/115941118741449240
Show threadnyckiJan 22
@mushu okay, why does she even HAVE that lever?
Show threadUn BourguignonJan 22
@mushu
Let's say that their security is bad as f*ck... And, if they can't do any restore, their resilience is even badder.
@R1Rail
Show threadI AM BANKSY ☕ / 🗑‍🔥Jan 23

@mushu "To me this is the visual language of Blockchain/NFT scams mixed with the butthole motifs that AI companies like so much."

Beautifully written :D

Show thread지지 ᚠᚱᛖᛃᚨ Daniel 黄法官 CyReVoltJan 24
@mushu thanks, I just noticed that the Electrolux logo is depicting a person wearing a thong, seen from behind and bending over, at an angle.
Show threadkaylimeJan 31
@mushu holy sh*t, i thought that dialog was more of a "The config files in this repo may contain an exploit targeting your extensions", not "We will intentionally autorun scripts from this repository"
Show threadPeritia System1d ago
@mushu
this is insane!
Show threadKat the Leopardess1d ago
@mushu Yup. This kind of situation also makes a case against spec work.