Is this coding test safe to run?

How fake coding tests infect developers

A recruiter reaches out on LinkedIn, Telegram or email with a well-paid role, often at a crypto or Web3 company. After a friendly chat comes the "technical step": clone this repo, run it and fix a bug, or join a video interview. The repo is a real-looking app with one extra piece that runs the moment you install or open it. North Korean groups have used this approach for years. Researchers call it Contagious Interview, and analysts suspect it in this year's largest exchange thefts. Read how it works.

What this checker reads

• npm install hooks. preinstall, postinstall and prepare scripts run by themselves. One that downloads or decodes code is the classic trap.
• VS Code auto-run tasks. A .vscode/tasks.json task with "runOn": "folderOpen" runs as soon as you open the folder and click Trust.
• Files that aren't what they're named. A script that runs node public/fonts/fa-solid.woff2 is running code disguised as a font.
• Code that downloads code. eval, new Function or Function.constructor next to a web request, including the trick of running an error response from the attacker's server.
• Hidden and scrambled code. Code pushed hundreds of spaces to the right of a config line, obfuscator output, long encoded blobs, paste-site dead drops.
• Program files. .exe, .dll, .dmg or .pkg files committed to the repo.

What a clean result means

Only that none of these tricks showed up in the up to 20 files it read. It does not read your dependencies' own install scripts, compiled programs or private repos, and attackers change tactics. Treat a clean result as "no known red flags", not as "safe".

How to do a take-home test safely

• Run it in a throwaway virtual machine or a cloud dev environment (GitHub Codespaces, Gitpod), never on the laptop with your password manager, wallets, SSH keys or work VPN.
• Open unknown folders in VS Code's Restricted Mode: click "No, I don't trust the authors". That blocks tasks and extensions from running.
• Read package.json and .vscode/ before anything else. Use npm install --ignore-scripts if you must install.
• A real employer won't mind you running their test in a sandbox. One that pushes back, rushes you or asks you to "fix your camera" with a terminal command is not a real employer.

Already ran it?

Disconnect the computer from the internet. From a different, clean device, change your passwords (email and password manager first), move crypto to a new wallet made on a clean device, and revoke SSH keys, API tokens and cloud sessions. If it was a work laptop, tell your security team now: these attacks are after the access your job gives you. Full steps are in the guide.

Protection while you browse

The PhishClean extension runs this check by itself when you open a repo on GitHub, GitLab or Bitbucket during the free trial and on a paid plan. It also warns, for free, when an interview page tells you to paste a "camera fix" into Terminal or the Run box.

Last updated: 1 November 2026