Sometimes the job interview just wants to gain code exec on your machine:

https://runjak.codes/posts/2026-01-21-adversarial-coding-test/

Local girl failed the coding interview:
I don't think they've got a job for me anymore now that I got their repos deleted⁉️

Thanks to @cxiao for highlighting these:

https://www.jamf.com/blog/threat-actors-expand-abuse-of-visual-studio-code/
https://opensourcemalware.com/blog/contagious-interview-vscode

.. I do know that the version of tokenlinux.sh I retrieved also downloads node and executes something with it.

Threat Actors Expand Abuse of Microsoft Visual Studio Code

Jamf Threat Labs uncovers North Korean hackers exploiting VS Code to deploy backdoor malware via malicious Git repositories in the Contagious Interview campaign

@mushu np, glad it didn't get you in this case and thanks for writing it up to warn others!

@mushu that is crazy... thanks for posting about it.

Is it just me, or could the dialog be a little more specific about WHAT it automatically executes? And: why do I want my IDE to automatically execute stuff in a repo I open? What is the positive use case of such a feature? (I am an IntelliJ user, so that is a genuine question)

@morl99 yes, I agree it could be more explicit. That'd also aid with the step of attackers trying to obfuscate the code execution by adding whitespace in the json.
@mushu @morl99 The problem is that it could give a false sense security. I'm not super familiar with vscode but I bet there are dozens ways of exploiting this, many of which are yet to be known. Blocking it all at once is the safe thing to do.

@mushu @morl99 I think IntelliJ also automatically executes stuff when you open a repo

https://www.jetbrains.com/help/idea/project-security.html

Project security | IntelliJ IDEA

IntelliJ IDEA Help

@joshix @mushu interesting, I have never felt the need for this: https://www.jetbrains.com/help/idea/settings-tools-startup-tasks.html

Maybe something for other ecosystems...

Startup Tasks | IntelliJ IDEA

IntelliJ IDEA Help
@mushu I hate how many inexperienced or unsuspecting devs are gonna fall for this :(
@codecat yeah, that's sad indeed.
@mushu sorry, non techie here: iiuc you detected foul play in the depository. Would it have infected your machine? Done something else?

@temptoetiam hey :)
yes - I was lucky to detect foul play and happened to be careful.

I found that software would've run that loaded and executed other software. From what I could see the setup in the end was one where my machine would've executed whatever the attackers wanted with user privileges.

I'm not 100% sure what the endgame would've been. Could've gone for ransomware, information stealing, botnets you name it.

@mushu thank you very much for your kind explanation!
@mushu oh yes, putting a lot of whitespace at the start of a command is a classic in roblox malware
@mushu Chripes, that sounds like a major misfeature in vscode.

@sol_hsa yeah - I also think it's bigger than a single editor. Jetbrains does it too: https://www.jetbrains.com/help/idea/project-security.html

Not even starting to think about editors that are more 'AI enabled' ^^

Project security | IntelliJ IDEA

IntelliJ IDEA Help
@mushu That's called dodging a bullet 
@mushu Maybe the real coding challenge was getting their repos deleted and now they'll offer you a job as their head of cyber security? 🤔
@mushu I hope you find less adversarial prospective employers!
@freya thanks 💖
If fedi is any measure there are amazing, kind people out there. Some of them even do software.
@mushu Did I got it wrong or was this a: "No Backup, No Mercy"-situation? I mean who gives more than strictly limited write access to strangers?
BTW: I got my first it-job as a tester by crashing their system during the interview.

@mushu
Wow, reading these comments made me remember this job I had briefly (over 15 years ago) in Stockholm.

I had a mac laptop, my work laptop was also a mac. And I was working with Postgres.

I had the job for about 2 weeks before they let me go.

I noticed at some point that they had installed a root-kit on my computer.
(the were a sports betting company)

@zedaardv outch - sorry to hear that 🫤

I mean there are some cases where device surveillance makes sense from a compliance perspective, but it should never be a surprise and be clearly documented upfront.

@mushu Yeah, it was a weird place.

They wouldn't tell me what they wanted me to do, then got mad at me when I didn't do it.

Like I was supposed to be a mind reader.

@mushu okay, why does she even HAVE that lever?
@mushu
Let's say that their security is bad as f*ck... And, if they can't do any restore, their resilience is even badder.
@R1Rail

@mushu "To me this is the visual language of Blockchain/NFT scams mixed with the butthole motifs that AI companies like so much."

Beautifully written :D

@mushu thanks, I just noticed that the Electrolux logo is depicting a person wearing a thong, seen from behind and bending over, at an angle.
@mushu holy sh*t, i thought that dialog was more of a "The config files in this repo may contain an exploit targeting your extensions", not "We will intentionally autorun scripts from this repository"
@mushu Yup. This kind of situation also makes a case against spec work.