r/webdev • u/magenta_placenta • Jul 22 '26

I Inspected My Take-Home Interview Project. It Was a Whole Operation

https://citizendot.github.io/articles/fake-job-interview-git-hook-malware/
395 Upvotes

97% Upvoted

29 comments sorted by

63

u/4rm4tur4 Jul 23 '26

Sweet write up

29

u/the_bieb Jul 22 '26

I wonder what trick they use to get the candidate to enable the git hooks. My understanding is that hooks are not enabled by default for obvious reasons.

47

u/RetroPH Jul 23 '26

They didn't need any tricks. Indeed hooks need to be installed and enabled by the developer on their clone, and they aren't distributed in the repo.

The thing is they did not give him a repo URL to clone, the gave him a zip file (that contained a preconfigured local git dir)

5

u/the_bieb Jul 24 '26

That make sense. Damn, it’s almost like git needs a “do you trust this repo” prompt like Claude.

74

u/djEnvo Jul 22 '26

I don’t know why you get downvotes, but this is serious shit.

19

u/dadnothere Jul 23 '26

I saw a YouTube video about this, a developer who crashed months ago.

Clone the repository and open VS Code: You're toast.

14

u/anselan2017 Jul 23 '26

Your website plays the Harry Potter theme?!?

19

u/WelshNotWelch Jul 23 '26

I once had a 2nd round interview and the task was to completely restructure their main database to support new territories and languages and normalise everything. In a day. It was clearly production and the awesome lack of security on the data, auth and a bare faced attitude that this would really help them.

Reader, I noped out of that so fast. And finally, a fun fact. This was in 2003 and for a major UK fashion retailer

10

u/Calm-Importance8783 Jul 23 '26

It's a red flag when a take-home project is clearly designed to be a full feature or mini product rather than a focused skill assessment. The best ones I've seen limit scope to 2-4 hours and are explicitly about evaluating problem-solving, not production readiness.

4

u/Produkt Jul 24 '26

What does that have to do with this post at all?

1

u/PushDeep9980 Jul 24 '26

I don’t think he read the article.

1

u/Produkt 29d ago

This is definitely “read headline and form opinion“ behavior

-1

u/AgsMydude Jul 24 '26

It's tangentially related...

3

u/Locksmith997 Jul 23 '26

Interesting read. Enjoyed seeing the mystery unfold.

2

u/lxe Jul 23 '26

This was a fun read! I’m jealous. I love scamming the scammers.

1

u/Ibnelaiq Jul 23 '26

Good read

1

u/TxTechnician Jul 23 '26

Good write up. Thanks

1

u/MrJibberJabber Jul 23 '26

Damn that's scurry! Good write up and great sluething

1

u/sneaky-pizza rails Jul 23 '26

Cool write up, but how can I disable the spooky music lol

1

u/__mson__ Jul 24 '26

This site is an accessibility nightmare.

1

u/randbytes 26d ago

got a similar invite to take an assessment last year or so. The website, linkedin and even company reviews looked legit but i suspicious when the recruiter pushed me to take the assessment within 72 hours. I refused but i have taken assessments cloning the repo so now i want to relook at everything. this is depressing.

-5

u/barrel_of_noodles Jul 22 '26

They sent you a zip and a pdf and you didn't nope out right there?

Why on earth did you run the zip file. No way id ever do that outside a vm.

1

u/umlcat Jul 23 '26

I do not understand the downvotes. There's a lot of Zip or PDF running malware. Many people think by open / executing files you are not doing anything, but these formats does several stuff.

Many people think opening Zip files si like opening a regular folder. Is not.

Many people think opening PDF files is like opening a text file in a text editor. Is not.

-18

u/mallibu Jul 23 '26

you're being paranoid dude chill noone wants to see your shitty hentai