Install Chain Insights
← All stories

Safety Academy · Story 20 · Malicious developer tools

Dream job. Nightmare homework.

A coding exercise wants to run beside Ken’s work credentials.

Estimated 4 min read

MALICIOUS DEVELOPER TOOLS6 scenes

A recruiter sends Ken a small coding exercise.

Ken receives a promising developer interview invitation. The recruiter sends a project to run before the call. His work computer contains credentials the exercise has no business needing.

Ken
“A paid role and a tiny demo. Nice.”
Illustration: A recruiter sends Ken a small coding exercise.

A job opportunity does not make a repository or download trustworthy.

The project says a helper is required.

The project asks him to install an interview helper and disable a warning. The scammer presents this as routine onboarding. The briefcase is professional; its contents are not.

The Scammer
“The interview starts when the malware starts.”
Illustration: The project says a helper is required.

Fake interviews can distribute malicious projects, packages or tools.

Ken pauses before running the setup.

Project scripts and dependencies may execute with access to Ken’s files and environment, even if the visible exercise looks harmless. He stops before setup runs.

Ken
“Why does a coding test need my everyday computer?”
Illustration: Ken pauses before running the setup.

Reading a repository and executing it are different trust decisions.

Captain Harold verifies the opportunity separately.

Captain Harold verifies the employer and contact independently, then reviews scripts and dependencies. Any evaluation belongs in an isolated environment without secrets or host access, with no guarantee that isolation fixes every risk.

Captain Harold
“A job interview should not interview your wallet.”
Illustration: Captain Harold verifies the opportunity separately.

A familiar code-hosting site does not certify a project as harmless.

He refuses the helper and separates any evaluation.

Ken cannot verify this invitation or safely assess the project, so he declines to run it. He contacts the real company through a known channel instead of the recruiter’s supplied link.

Ken
“The demo can have a sandbox. Not my keys.”
Illustration: He refuses the helper and separates any evaluation.

Use an appropriately isolated environment for necessary evaluation. Decline work you cannot assess safely.

The “interview” never reaches his accounts.

The project never executes on his trusted workstation. A real opportunity can survive sensible verification. The scammer’s interview calendar has an unexpected vacancy.

Ken
“Apparently my strongest skill is not running that.”
Illustration: The “interview” never reaches his accounts.

The habit: treat developer tools, coding tests and extensions as executable code.

The useful bit

A coding task or extension can run code beside your credentials.

  1. Verify a recruiter through contact details you found yourself.
  2. Read a take-home project's scripts and dependencies before running anything. Run it where no credentials live.
  3. Decline a task you cannot check safely. A job offer is not a reason to switch off protection.

I already did this

If the exercise ran, stop using the device for sensitive work and contact your security team. Follow official device guidance and revoke and replace exposed service credentials from a clean setup. If wallet keys were accessible, follow the wallet incident guide. Uninstalling alone is not containment.

Sources & further reading