Is that GitHub repo a trap?
Paste a repo link and check it for fake-interview malware before you run it.
How the “fake interview” scam works
- 1
A recruiter reaches out
Often on LinkedIn or Telegram, for an attractive remote role, usually at a crypto, Web3, AI, or fintech startup you can't quite verify.
- 2
You get a “take-home task”
They send a GitHub repo and ask you to clone it, run npm install (or npm run dev), fix a small bug, and screen-share or report back. It looks like a normal coding challenge.
- 3
The trap springs on install
Hidden inside the project, typically in an install script, or buried in an innocent-looking config file, is code that runs automatically the moment you install or start it. You never even have to open the malicious file.
- 4
It steals what's on your machine
The payload hunts for browser passwords and cookies, crypto wallets and extensions like MetaMask, SSH keys, and API keys in your environment, and quietly uploads them. Some variants install a backdoor for later.
The golden rule: never run code from a stranger on the machine that holds your passwords and wallets. A legitimate interviewer will not mind if you review the code first, ask questions, or run it in a throwaway virtual machine.
What RepoCanary checks
- Scripts that auto-run on npm install (preinstall / postinstall)
- Obfuscated or minified code hiding in normal-looking files
- Code that reads your passwords, keys, or environment secrets and sends them out
- References to crypto wallets, browser data, and keychains
- Code that downloads and executes more code from the internet
- Fishy account signals: brand-new orgs, empty “companies”, typosquatted packages