LinkedIn Job Offer Backdoor: Analyzing a Social Engineering Attack

A developer recently detailed a sophisticated social engineering attack where a fake recruiter on LinkedIn lured them into reviewing a GitHub repository that contained a backdoor. The attack leveraged the npm install process to execute arbitrary remote code on the victim's machine, highlighting a critical vulnerability in how developers trust third-party code during technical interviews.

The Attack Vector: npm 'prepare' Scripts

The primary mechanism for the backdoor was the prepare lifecycle script in package.json. In the Node.js ecosystem, npm install automatically triggers the prepare script after dependencies are installed. The attackers used this to ensure their malicious code would execute immediately upon the victim attempting to set up the project.

Execution Flow

  1. Bait: The recruiter asked the target to "check out the deprecated Node modules issue," specifically prompting them to run npm install to reproduce the issue.
  2. Trigger: The package.json contained a prepare script that ran npm run app:pre, which in turn executed node app/index.js.
  3. Payload: app/index.js required app/test/index.js, which contained the actual backdoor.

Technical Breakdown of the Backdoor

The malicious payload was hidden within app/test/index.js, disguised as a test suite. The code used string fragmentation to obscure the command-and-control (C2) server URL, assembling it from fragments like protocol, domain, and path to avoid simple static analysis.

Obfuscation Techniques

  • String Fragmentation: The URL https://rest-icon-handler.store/icons/77 was broken into multiple variables to hide the destination.
  • Visual Camouflage: The payload was placed on a single minified line (line 225) surrounded by hundreds of lines of commented-out test code, making it easy to overlook during a manual review.
  • Remote Execution: The payload was designed to fetch and execute whatever code the C2 server sent back to the machine, creating a flexible second-stage attack.

Identity Theft and Impersonation

The attackers utilized "borrowed identities" to establish trust and bypass initial suspicion:

  • Developer Impersonation: The GitHub repository's commit history (39 commits) was attributed to a real full-stack engineer. The actual developer confirmed they had never worked for the company and had been impersonated before.
  • Recruiter Impersonation: The LinkedIn profile used for outreach was that of a real arts journalist with no technical background. Once the target began discussing technical issues, the attacker suddenly displayed expert-level knowledge of Node.js versions and npm, revealing the profile's fraudulent nature.

Community Insights and Patterns

Discussion among developers on Hacker News reveals that this is a widespread pattern, often targeting those in the crypto and Web3 space.

Common Themes in Similar Attacks

  • Targeting Crypto Developers: Multiple users reported similar experiences, with some suggesting these attacks are the work of organized groups like the Lazarus Group (DPRK).
  • High-Pressure Tactics: Attackers often use pushy behavior, insisting the candidate run the code locally to "fix" a problem.
  • Long-Game Social Engineering: One victim reported a 30-minute video call where the recruiter's camera remained off, creating a sense of legitimacy before the final push to install the malware.

"This is uncomfortably close to a normal interview task now. Someone sends you a repo, says the install is broken, and asks you to take a look. A lot of developers would run npm install before thinking twice."

Defensive Recommendations

To prevent infection from suspicious repositories, developers should adopt a strict security hygiene for technical assessments:

  • Use Isolated Environments: Never run npm install or execute code from an unknown source on your primary machine. Use a throwaway VPS, a dedicated virtual machine (VM), or a containerized environment.
  • Leverage AI for Initial Audits: In this case, the victim used a read-only agent (Pi) to scan the codebase. The agent flagged the suspicious code in seconds, whereas a manual review might have taken longer.
  • Verify Identities: Be skeptical of recruiters who push for local execution of code or whose professional backgrounds do not align with their technical demands.

Sources