I really want to know what would've happened with an npm install, I guess something boring like crypto mining or identity theft?
You can actually test it yourself. The actual URL is in the post and the website is still up.
A backdoor in a LinkedIn job offer
11–20 of 331 posts
Re: A backdoor in a LinkedIn job offer
#12This is very likely Lazarus Group - specifically Famous Chollima aka the DPRK
Re: A backdoor in a LinkedIn job offer
#13Thought: they may be targeting software developers on the assumption they may have legit credentials lying around from other employers or for public open source projects, or at a minimum some reputation to exploit towards obtaining commits to the same for supply chain attacks.
Re: A backdoor in a LinkedIn job offer
#14So, this is a crime right? Why isn't there a well known '911' for cybercrime to report things like this to and get help? Society needs to catch up with the actual dangers out there and build support networks for this ASAP. This is organized crime and needs organized defense to deal with it.
Unfortunately most evil cybercriminals know the "one weird trick" of "do your crimes in countries that don't care about the crimes"
Re: A backdoor in a LinkedIn job offer
#15Ah, c'mon! You went all the way to find out the issue and write about it, and won't do the most interesting part which is to tell us what was the remote script that would end up running!?
Re: A backdoor in a LinkedIn job offer
#16> a recruiter at a small crypto startup [...] she described a broken proof-of-concept they needed a lead engineer for, and then sent me a public GitHub repo to review. Specifically, she asked me to “check out the deprecated Node modules issue.”
> ...buried between walls of commented-out tests, the payload runs anything the server sends back to your machine.
> npm runs prepare automatically after npm install, so just installing dependencies executes the backdoor.
> The instruction to “check out the deprecated Node modules issue” was bait to get me to run npm install.
Great catch. I've not been phished on LinkedIn before. Surprised it's getting this bad.
Re: A backdoor in a LinkedIn job offer
#17So, this is a crime right? Why isn't there a well known '911' for cybercrime to report things like this to and get help? Society needs to catch up with the actual dangers out there and build support networks for this ASAP. This is organized crime and needs organized defense to deal with it.
the main issue is that we lack a global '911'.
secondary is the effort asymmetry between spinning up one of these scams (near 0 effort) and catching/prosecuting these scams (big effort, astronomical cost)
Re: A backdoor in a LinkedIn job offer
#18So, this is a crime right? Why isn't there a well known '911' for cybercrime to report things like this to and get help? Society needs to catch up with the actual dangers out there and build support networks for this ASAP. This is organized crime and needs organized defense to deal with it.
https://www.ic3.gov
You won't hear back from them, though. But, at least for US citizens (and possibly for anyone?), this is as far as I know the closest thing there is to an "Internet 911".
Re: A backdoor in a LinkedIn job offer
#19I’ve seen a few of these – malicious repos to clone, fake call links that prompt for “driver” downloads, and so on.
The only way around it is to be hyper-vigilant if anyone asks you to run any untrusted code on your computer.
Re: A backdoor in a LinkedIn job offer
#20So, this is a crime right? Why isn't there a well known '911' for cybercrime to report things like this to and get help? Society needs to catch up with the actual dangers out there and build support networks for this ASAP. This is organized crime and needs organized defense to deal with it.
To put it bluntly and perhaps a bit cynically, on the tree of bad things that people do to other people, this is pretty high-hanging fruit. Right up there next to scam phone calls that prey on the elderly while claiming to be from Microsoft support.
It's basically impossible to catch suspects because they are either smart enough to cover their tracks very well, or (more often) live in countries whose governments don't care about their citizens (even pay them for) scamming westerners.