Workforce and access social engineering · Also called fake coding test, malicious npm package, package registry phishing, fake technical interview, developer supply chain lure
Developer-targeted lures (fake job tests and malicious packages)
Developer lures are attacks aimed at software developers: a fake job offer with a coding test that runs malicious code, a malicious package in a public registry, or a phishing email that steals a maintainer's registry login. The goal is to steal credentials, source code, or cryptocurrency, or to spread malware through trusted software.
How it works
- Attackers pose as recruiters or technology firms, sometimes with stolen photos and fake websites, and build rapport over a long conversation.
- They ask the developer to complete a pre-employment test or debugging exercise that runs unfamiliar Node.js packages, sometimes on a company device.
- Separately, attackers upload malicious packages to registries such as npm, or phish package maintainers with fake two-factor authentication reset emails from look-alike domains and publish poisoned versions of trusted packages.
- The malware hunts for credentials such as GitHub tokens and cloud API keys and sends them to the attackers; some variants spread to other packages the victim maintains.
Red flags
- A recruiter asks you to run code or install an application for a test, especially on a work device.
- The task insists on non-standard software or unknown packages to complete something simple.
- An unexpected job offer from a well-known firm comes with unusually high pay and no negotiation, and pressure to move to another messaging app.
- An email from a domain that imitates your package registry says you must update your two-factor authentication.
If you are targeted
- Stop: do not run the code, and stop contact with the recruiter until you have verified them through a separate channel.
- If you already ran it, tell your security team and rotate every developer credential, including GitHub tokens, registry tokens, and cloud keys.
- Review your recent package publishes and repositories for changes you did not make.
- Report it to your security team, then to the national service; our Report a scam page lists where, such as ic3.gov in the US.
Prevention
For individuals
- Run take-home tests only in an isolated virtual machine, never on a work computer.
- Verify recruiters and companies through a channel you find yourself, not one they supplied.
- Use WebAuthn security keys rather than one-time codes for registry and code hosting accounts, and go to the registry directly rather than following email links.
For organisations
- Ban running code from outside parties on company devices, and give developers isolated virtual machines for any external test.
- Require phishing-resistant MFA on all developer accounts, especially GitHub and npm, and prefer trusted publishing over long-lived tokens.
- Review dependencies against lockfiles, pin versions to known good releases, and turn on secret scanning and branch protection.
By the numbers
Figures are for the reporting category this scam falls under, not this scam alone.
| Malware losses reported to the FBI IC3 in 2025 | $19.4M | US, 2025, FBI IC3 |
Real cases
2025-02 · Location not reported · Disclosed · $1.5B stolen
Bybit loses about $1.5 billion to North Korea's TraderTraitor, 2025
Delivered through: Spear phishing, Email phishing
How official datasets classify it
- FBI IC3
- Malware
- MITRE ATT&CK
- T1566.003, T1204.005, T1195.001
Questions
- Can a coding test for a job infect my computer?
- Yes. The FBI has warned of North Korean actors who ask candidates to run a pre-employment test or debugging exercise that executes unknown Node.js packages. Run any test in an isolated virtual machine.
- What should developers do after a malicious npm package is found?
- CISA advises reviewing dependencies, pinning packages to known safe versions, rotating all developer credentials, and requiring phishing-resistant MFA on developer accounts.