Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A backdoor in a LinkedIn job offer

roman.pt

Post reply on HN
Print view View original

161–170 of 331 posts

Re: A backdoor in a LinkedIn job offer

#161

Post by prawn »

pants2 wrote: post #56
wxw wrote: post #16

> a recruiter at a small crypto startup [...] she described a broken proof-of-concept they needed a lead engineer for, and then sent me a public GitHub repo to review. Specifically, she asked me to “check out the deprecated Node modules issue.” > ...buried between walls of commented-out tests, the payload runs anything the server sends back to your machine. > npm runs prepare automatically after npm install, so just…

LinkedIn offers no way for $company to disavow users who claim to work for $company - they will appear on the official company page as long as it's in their profile. We've had fake recruiters that claim to work for us running basically the same scam. These are great fake profiles: LinkedIn Premium, tons of relevant posts, etc... but they don't work for us, and we get angry messages from people saying our recruiter tr…

How does that not become a legal issue?

Re: A backdoor in a LinkedIn job offer

#162

Post by ekianjo »

saaspirant wrote: post #149
dataviz1000 wrote: post #147

I don't have a LinkedIn profile. ~50% of jobs listed on who is hiring every month require a LinkedIn profile to submit a job application. In order to find a job, one must bend the knee to LinkedIn first and subjugate themselves to the political (all sides) propaganda on the feed.

I use a Firefox extension to block the feed

Wait until the extension gets acquired by a third party and turns into malware

Re: A backdoor in a LinkedIn job offer

#163

Post by [deleted] »

jjice wrote: post #65
afpx wrote: post #51

Earlier quoted context omitted.

Github / Microsoft could easily fix this, couldn't they? Leaving NPM up in its current state seems criminal, especially since LLMs generate NPM commands so frequently.

They have some changes here in v12: https://github.blog/changelog/2026-06-09-upcoming-breaking-c...

[deleted]

Re: A backdoor in a LinkedIn job offer

#164

Post by [deleted] »

nijave wrote: post #110
gleenn wrote: post #32

Earlier quoted context omitted.

Friends don't let friends use NPM. At this point it is so wildly crazy watching people get owned, I don't understand how anyone uses it when they could use e.g. PNMPM and block one if the most obvious and frequently exploited holes. These tools with arbitrary code execution when trying to download some code have got to stop. Edit: typos

>These tools with arbitrary code execution when trying to download some code have got to stop But you still end up with the code on your machine and risk it being ran. Bigger issue is giant, inscrutible dependency trees. In this example, if they tried to run the test suite or application, they'd have been in the same boat. Afaik all or most languages have some way to run arbitrary code at install time but it seems no…

[deleted]

Re: A backdoor in a LinkedIn job offer

#165

Post by mock-possum »

elwebmaster wrote: post #99

Why is npm still not blocked by every OS on earth is beyond me. These guys will never learn.

Because uh every OS on earth has the exact same vulnerabilities? How are you supposed to stop a user from downloading something random from the internet and running it?

Re: A backdoor in a LinkedIn job offer

#167

Post by blharr »

contingencies wrote: post #13

Thought: they may be targeting software developers on the assumption they may have legit credentials lying around from other employers or for public open source projects, or at a minimum some reputation to exploit towards obtaining commits to the same for supply chain attacks.

Or, you know... money

Re: A backdoor in a LinkedIn job offer

#168

Post by Joel_Mckay »

elwebmaster wrote: post #99

Why is npm still not blocked by every OS on earth is beyond me. These guys will never learn.

npm is hard to avoid, as other ecosystems have integrated it as a cross-platform build/installer script bootstrap.

Indeed, all things nodejs are usually a dumpster fire at a hair salon, but the real point here was people always inherit whatever the previous cheapest labor built at that office. Also, usually people don't get to make architectural decisions for a long time. =3

Re: A backdoor in a LinkedIn job offer

#169

Post by Joel_Mckay »

PufPufPuf wrote: post #119
elwebmaster wrote: post #99

Why is npm still not blocked by every OS on earth is beyond me. These guys will never learn.

Nothing to do with nom itself. This sort of scam would have worked with many different technologies, even a Makefile.

Cat related technology like noms and toe beans are immune to this exploit. =3

Re: A backdoor in a LinkedIn job offer

#170

Post by Joel_Mckay »

mock-possum wrote: post #165
elwebmaster wrote: post #99

Why is npm still not blocked by every OS on earth is beyond me. These guys will never learn.

Because uh every OS on earth has the exact same vulnerabilities? How are you supposed to stop a user from downloading something random from the internet and running it?

Some posix like systems mount /home with noexec in fstab.

Practically, most systems leave it off because many out-of-band user space script language package ecosystems stop working. =3

There are also adaptive application firewalls that are user friendly.

https://github.com/evilsocket/opensnitch

Post reply on HN