I didn't read everything, but I had a DM offering a gig a few weeks ago, and asked me to check out a React site/app. I cloned it and it looked dubious; replied I pass.
A backdoor in a LinkedIn job offer
231–240 of 331 posts
Re: A backdoor in a LinkedIn job offer
#232I'm seeing the same. Worth flagging that maintainers seem to be a specific target now, not just job seekers. If you've got commit access to anything popular, backdoors like this become a lot more dangerous, because the supply-chain payoff is much bigger than your laptop
Re: A backdoor in a LinkedIn job offer
#233Why is npm still not blocked by every OS on earth is beyond me. These guys will never learn.
fyi npm 12 will have securer defaults https://github.blog/changelog/2026-06-09-upcoming-breaking-c... but it will be a while for ecosystem to catch up and npm reputation already damaged
Re: A backdoor in a LinkedIn job offer
#234Damned, there is a market for an "antivirus for developers".
Re: A backdoor in a LinkedIn job offer
#235Earlier quoted context omitted.
>I finally got it solved by buying drinks for a buddy of mine that works for LinkedIn I'd like people to understand that this is a form of corruption. We've normalized many like it. LI knows that the only way to force them to fix the issue is to go through a drawn-out legal process, save a spate of bad press (RIP 60 Minutes), so of course they won't.
[flagged]
> corruption necessarily envolves the government
False. [0] If the bank teller demands a bribe to let you withdraw from your account, that's corruption, even though they aren't working for the government.
> Corruption is the dishonest, fraudulent, or criminal use of entrusted authority or power for personal gain or other unlawful or unethical benefits. Corruption occurs in politics, business, education, media, and other social and economic fields.
Re: A backdoor in a LinkedIn job offer
#236> but on a more tired or rushed day, I could easily have run npm install before thinking it through
Re: A backdoor in a LinkedIn job offer
#237How about running that backdoor from a honeypot and check what it is trying to do?
Re: A backdoor in a LinkedIn job offer
#238> a recruiter at a small crypto startup [...] she described a broken proof-of-concept they needed a lead engineer for, and then sent me a public GitHub repo to review. Specifically, she asked me to “check out the deprecated Node modules issue.” > ...buried between walls of commented-out tests, the payload runs anything the server sends back to your machine. > npm runs prepare automatically after npm install, so just…
> a recruiter at a small crypto startup
That's all you need to know they're criminals and frauds.
Re: A backdoor in a LinkedIn job offer
#239Earlier quoted context omitted.
Bwahaha, no it doesn’t. Legally ‘corruption’ doesn’t exist, as in there is no single law saying ‘corruption is illegal’. (What is ‘corruption’ exactly?) There are laws against bribery, which does generally only apply to the government, but in many locations applies to pseudo-government roles like notaries, apostiloes, lawyers, etc. There are laws against embezzlement (a type of corruption), and those definitely apply…
Brazillian law, for instance, defines the crimes of passive and active corruption: The Penal Code, in Article 317, defines the crime of passive corruption as "soliciting or receiving, for oneself or for others, directly or indirectly, even if outside the function or before assuming it, an undue advantage, or accepting a promise of such an advantage." [0] Active corruption, committed by an outsider, who offers or prom…
That is literally just a translation difference for bribery, a common issue for Brazilian Portuguese vs English.
[https://www.jusbrasil.com.br/topicos/10598684/artigo-317-do-...].
Re: A backdoor in a LinkedIn job offer
#240Earlier quoted context omitted.
Unfortunately most evil cybercriminals know the "one weird trick" of "do your crimes in countries that don't care about the crimes"
Something I've always wondered, because I'm a bit of a contrarian and I wonder if we're really any different: Could an American citizen hack and steal from Iranians and Russians with impunity from America? The issues that prevent the US from extraditing Russians who hack us -- don't they work both ways?
Legally speaking, no - it would still be a criminal offence.
Practically speaking, there is zero chance that the USA would extradite someone to Iran, even if they weren't currently at war with them. Whether they did anything about it would probably depend on exactly what the situation was - there's a big of difference between targeted IRGC or defence systems and ransomwaring an Iranian hospital or scamming random citizens.
Where they'd probably get you is if you tried to monetise it, and get stolen/extorted cryptocurrencies (or whatever) into your bank account. But that could easily fall under tax evasion laws rather than computer misuse ones, because they'd be a lot easier to prove in court.