now imagine if you were like the rest of us and didn’t write a blog post about it
[dead]
Been going on for over half a decade
I think we need a different kind of PSA if its still so new to people
A backdoor in a LinkedIn job offer
131–140 of 331 posts
Re: A backdoor in a LinkedIn job offer
#132Earlier quoted context omitted.
Won't that require laws that allow the said agency to compel LinkedIn or whatever tech company to actually pay attention and take action? Like laws compelling tech companies to unlock the bootloader once they stop supporting a device. I wonder why such common sense laws don't exist and who is preventing them from being introduced and passed despite wide public support in general?
I'm not a lawyer but it would be odd if a government agency couldn't communicate a possible threat to a tech company. It is in a company like LinkedIn's best interest to set up a phone number/channels for a centralized agency to communicate potentially malicious accounts and other emerging threats. I suspect that actually already exists for big companies. I doubt they are required to -do- anything without laws but th…
You're describing the FBI or your state level equivalent. And they actually do exactly what you are describing, but in measured efforts. I've even had them come by my place of employment before. They clearly lack the resources to work at this scale though.
The problem with a phone number you suggest is that it will get spammed and abused with fraudulent imposters too (the complete and utter destruction of trust in phone calls and text messages should also be corrected by the government, but that's a different topic).
Re: A backdoor in a LinkedIn job offer
#133> I reported the repo to GitHub and the recruiter to LinkedIn. So far nothing has changed and the code is still up.
Github is really slow when it comes to malicious repos. You'll probably get an email randomly six months from now when they finally see it.
Re: A backdoor in a LinkedIn job offer
#134I had a similar experience, just by email.
https://blog.denv.it/posts/i-was-likely-targeted-by-dprk-in-...
It was likely DPKR.
Re: A backdoor in a LinkedIn job offer
#135Earlier quoted context omitted.
Github / Microsoft could easily fix this, couldn't they? Leaving NPM up in its current state seems criminal, especially since LLMs generate NPM commands so frequently.
They have some changes here in v12: https://github.blog/changelog/2026-06-09-upcoming-breaking-c...
And the discussion here, with 215 comments: https://news.ycombinator.com/item?id=48467705
Re: A backdoor in a LinkedIn job offer
#136> a recruiter at a small crypto startup [...] she described a broken proof-of-concept they needed a lead engineer for, and then sent me a public GitHub repo to review. Specifically, she asked me to “check out the deprecated Node modules issue.” > ...buried between walls of commented-out tests, the payload runs anything the server sends back to your machine. > npm runs prepare automatically after npm install, so just…
[deleted]
Re: A backdoor in a LinkedIn job offer
#137Earlier quoted context omitted.
Friends don't let friends use NPM. At this point it is so wildly crazy watching people get owned, I don't understand how anyone uses it when they could use e.g. PNMPM and block one if the most obvious and frequently exploited holes. These tools with arbitrary code execution when trying to download some code have got to stop. Edit: typos
Github / Microsoft could easily fix this, couldn't they? Leaving NPM up in its current state seems criminal, especially since LLMs generate NPM commands so frequently.
[deleted]
Re: A backdoor in a LinkedIn job offer
#138Earlier quoted context omitted.
Is it possible to fix it in a backwards compatible way? Removing lifecycle scripts is at least a semver major change, and would complicate existing projects relying on packages with lifecycle scripts from upgrading.
This is a real world trolley problem scenario. You can break workflows or you can let everyone get pwned by supply chain attacks. Which is the greater harm?
People will not adopt a safer version if it broke their workflows. Adoption is part of preventing supply chain attacks.
Re: A backdoor in a LinkedIn job offer
#139Been through this 3 times in the last 6 months. They're getting better. Very credible LI profiles, code looks OK if you only take a glance... The bell start ringing when they insist you to run locally their sh*t
Re: A backdoor in a LinkedIn job offer
#140> I reported the repo to GitHub and the recruiter to LinkedIn. So far nothing has changed and the code is still up. Oh, Microsoft.
I once saw an ad on LinkedIn made up to look like the CBC (Canadian news) linking to a fake video of the Canadian prime minister announcing a crypto investment plan for all Canadians, with a link to sign up. I reported the ad to LinkedIn and shortly after got a reply telling me they investigated and didn’t find any violation of their policies.
I’ve seen this fake Carney garbage on YouTube. Money speaks louder than truth.