Opening the project folder was enough
The approach was an interview and a paid take-home assignment, and the assignment was a GitHub repository to work from. The candidate who received it opened it up and published what was inside, posting as /u/Chance-Roll-2408, and what came out of it names the company by its domain rather than by its name.
“If you were contacted for a job interview or a paid take-home coding assignment by a company using the domain wynnaiarena[.]com, do not run the GitHub repo they send you. It contains a backdoor that downloads and executes a remote script the moment you open the project.”
One file does that, and it is not the assignment:
".vscode/tasks.json runs the build automatically as soon as you open the
folder in VS Code, with no terminal shown and no command echoed." A second file
conceals the first rather than running anything itself:
".vscode/settings.json hides the .vscode directory from the file explorer,
so you never see it."
What the build reaches is a dependency, goappconf/strconf, whose
Initialize() function pipes a script from a server the sender controls straight
into the shell. “The attacker controls that server, so the payload can be
anything at any time: credential theft, SSH keys, browser data, crypto wallet
drainers, or a persistent implant.”
Not opening the folder in an editor is no protection either. “The README also
tells you to run go run ., make start, or go run . test. All of these
trigger the same payload even if you never open VS Code.”
The method is documented, even if this particular repository is not. Using editor tasks to execute code the moment a project is opened has been written up as a technique used against developers approached with fake recruitment assignments — a description of how the trick works, not of who was behind the repository sent here.
They reported the repository and the package to GitHub, and the profile that had approached them to LinkedIn. Then they wrote down how it worked.
“Posting so anyone else who gets a ’take-home assignment’ from this outfit knows not to run it.”
The delivery mechanism here is not a clever exploit. It is a convention. A candidate is asked to clone a stranger’s repository onto their own machine and run it, on their own time, before anyone has committed to anything — and the request is so ordinary that it arrives without a second thought on either side. The attack never had to defeat suspicion. Recruitment had already retired it.
Every property this needs, the take-home assignment already supplies. It moves the work onto the candidate’s hardware, where an employer’s controls do not reach and nobody is watching. It ships with instructions to execute, and following them is the test. It arrives before any relationship exists, so there is nothing to check the sender against. And it carries a penalty for hesitating: the candidate who asks why the project wants to build itself on open is the candidate who is difficult, slow, not keen enough to want the role.
The offer of payment is the last piece. It reads as proof that the employer is serious, and it is the cheapest thing in the exchange to promise — a candidate who has been told the assignment is paid has one more reason to start it and one fewer to ask questions first.
What separates this from a warning is that they took the thing apart and published how it worked. The generic advice — be careful with unsolicited repositories — is unusable, because being careful is indistinguishable from being uncooperative when the assignment is the interview. Two file paths and a function name are usable. That is a candidate doing the diligence the process assumed someone else had already done, then handing it to the next candidate for nothing.