A developer documented a malware attempt disguised as a legitimate job opportunity on LinkedIn.
The attack used a malicious Node.js repository posing as a real estate tech project, leveraging npm’s postinstall hook and Function.constructor to dynamically load and execute remote payloads designed for C2 access, credential theft, and file exfiltration.
The setup closely matches what NVISO described in November 2025 for the DPRK-aligned Contagious Interview campaign: a fake LinkedIn recruiter, a real estate demo project, a Base64 “API key” in server/config/.config.env that decodes to a JSON Keeper URL, and a loader in server/controllers/userController.js.
Supply chain attacks via fake job offers, because apparently the worst thing about LinkedIn recruiters can always get worse.
