>Blockchain company
Is that no longer a red flag?
I almost got hacked by a 'job interview'
121–130 of 534 posts
Re: I almost got hacked by a 'job interview'
#122> The scary part? This attack vector is perfect for developers. We download and run code all day long. GitHub repos, npm packages, coding challenges. Most of us don't sandbox every single thing. Embedded into this story about being attacked is (hopefully) a serious lesson for all programmers (not just OP) about pulling down random dependencies/code and just yolo'ing them into their own codebases. How do you know your…
Sadly, this is a lesson that we should have learned some time ago. But from our past failure to learn, we can reliably predict that people will continue avoiding learning.
Supply side attacks are real, and they're here. Attackers attack core developers, then get their code into repositories. As happened this year to the npm package eslint-config-prettier, and last year to the Cyberhaven Chrome extension. Attackers use social engineering to get developers to hand over control of lesser used packages, which they then compromise. As happened in 2021 with the npm package ua-parser-js, and separately with the Chrome extension The Great Suspender. (I'm picking on Chrome because I wanted examples that impact non-developers. I'm only picking on npm because it turned up quickly when I looked for examples.)
The exact social engineering attack described by the OP is also not new. https://www.csoonline.com/article/3479795/north-korean-cyber... was published last year, and describes this being used at scale by North Korea. Remember, even if you don't have direct access to anything important, a sophisticated attacker may still find you useful as part of a spearphishing campaign aimed at someone else. Because a phishing attack that actually comes from a legitimate friend's account may succeed, where a faked message would not. And a company whose LinkedIn shows real developers, is more compelling than one without.
Re: I almost got hacked by a 'job interview'
#123I've been posting on HN's "who wants to be hired" and "freelancer" posts, and for the last couple months all I've got have been suspiciously similar emails from randoms asking me to schedule an online interview for a great "opportunity". They never state exactly what that "opportunity" is about. After some hours of not participating on it they will write again - have got three of them, from different gmail emails, al…
As the economy enters recession there's going to be more and more desperate people and criminals will exploit this.
As with OP's case, do not accept take home assignments unless they are FANG famous or very close to that.
In addition, opacity about opportunities should be #1 flag. There is no reason for someone serious to be opaque about filling a role and then increasing the amount of vetting. Also there is no reason to not telling you salary (this alone will help you filter out low paying jobs) for the same reason.
Usually hiring managers will look to always filter down list of candidates not increase them (unless they were lazy or looking to waste time).
Re: I almost got hacked by a 'job interview'
#124Earlier quoted context omitted.
I think it's a real company. https://search.sunbiz.org/Inquiry/CorporationSearch/SearchRe... ~~Scammers probably got access to the guy's account.~~ (how to make strikethrough...) He changed his LinkedIn to a different company. I guess check verifications when you get messages from "recruiters."
> (how to make strikethrough...) Unfortunately(?) you can't: https://news.ycombinator.com/formatdoc
this is how you make ̶s̶t̶r̶i̶k̶e̶t̶h̶r̶o̶u̶g̶h̶ ̶ words struck through [1]
Re: I almost got hacked by a 'job interview'
#125> sandbox everything. Docker containers Docker is not a sandbox. How many times does this needs to be repeated? If you are lazy, I would highly suggest to use incus for spinning up headless VMs in a matter of seconds
You can harden your Docker configuration (to not expose anything important) and then you can turn it into a sandbox by using the runsc/gvisor (emulated kernel) runtime. The configuration part alone would be sufficient for 99.9% of attacks, as it would require a kernel 0day to escape or exploit the kernel.
But it's best to just run a dev environment in a VM. Keep in mind that sophisticated attacks may seek to compromise the built binary.
Re: I almost got hacked by a 'job interview'
#126The pseudonym "Mykola Yanchii" on LinkedIn [1] doesn't look real at all. Click "More" button -> "About this profile", RED FLAGS ALL OVER. -> Joined May 2025 -> Contact information Updated less than 6 months ago -> Profile photo Updated less than 6 months ago Funny things, this profile has the LinkedIn Verified Checkmark and was verified by Persona ?!?! -> This might be a red flag for Persona service itself as it migh…
LMAO this post on his page has to be an AI generated map, it puts the UAE in Bangladesh.
https://www.linkedin.com/posts/mykola-yanchii-430883368_hiri...
Anyway I think we can add OP's experience to the many reasons why being asked to do work/tasks/projects for interviews is bad.
Re: I almost got hacked by a 'job interview'
#127I had several crypto job 'offers', from somewhat obviously hacked accounts, all of which pointed me to the same version of a repo, where you had to finish some crypto-related task to be considered for the project.
You were intended to run the project and implement some web3 functionality. I assumed it would try to access my wallet, so I ran it in a safe environment, but it only tried to access an endpoint that was already stale.
I forked the project for future reference and was later contacted by a French cybersecurity researcher who found my repo, and deobfuscated code that they had obfuscated. He figured out that it pointed to North Korean servers and notified me that those types of attacks were getting very common.
The group responsible for this activity is known as CL-STA-0240. When it works, the attack installs BeaverTail, InvisibleFerret, and OtterCookie as backdoors.
Here is some more info on these types of attacks: https://sohay666.github.io/article/en/reversing-scam-intervi...
Re: I almost got hacked by a 'job interview'
#128LLM writing patterns detected; opinion dismissed.
Lol jk. The Mykola Yanchii profile checked out, as a sibling comment notes, and it was indeed super sketch. And this is the reason why if someone asks that I install spyware on my computer as part of their standard anticheat measures during the screening process (actually happened to me) my response is no, and fuck you.
But it was written largely by LLM, and I feel the seriousness with which I take it being lowered. It's plausible that the guy behind this blog post is real, and just proompted his AI assistant "write me a blog post about how I almost got hacked during a job interview, and cover this, this, this, and this"... but are there mistakes in the account that slipped through? Or maybe there's a hidden primrose path of belief that I'm being led down? I dunno, I just have an easier time taking things at face value if I believe that an actual human hand wrote them. Call it a form of the uncanny valley effect.
Re: I almost got hacked by a 'job interview'
#129I know Node has the new permissions model thing, but why can’t this be as easy as blocking all fs access above cwd? I’d love a global Node setting for this.
Re: I almost got hacked by a 'job interview'
#130Earlier quoted context omitted.
How am I supposed to become a real, trustable person on LinkedIn if I'm not already there?
Create an account and let it age. Seasoned accounts are a positive heuristic in many domains, not just LinkedIn. For example, I some times use web.archive.org to check a company's domain to see how far back they've been on the web. Even here on HN, young accounts (green text) are more likely to be griefing, trolling, or spreading misinformation at a higher rate than someone who has been here for years.
All of the Year 1 Facebook accounts with more than a decade of activity that have been inexplicably banned and deleted in 2025 salute you.