A LINKEDIN JOB OFFER TRIED TO INSTALL MALWARE ON MY MACHINE

Summary from the TLDR InfoSec newsletter

The author received a LinkedIn post about a freelance opportunity to evaluate the codebase of a real estate tech platform with a legitimate-looking platform and a generous budget. The author accepted the offer and was given access to the codebase, but missed red flags such as a missed call with their Tech Manager, suspicious git history, and suspicious indicators in their contact's LinkedIn profile. Upon reviewing the repository, the author found an npm post-install script that would download a C2 backdoor, exfiltrate sensitive files, and capture keystrokes.