# Is this coding test safe to run?

> Paste the repo a recruiter sent you. See whether npm install or opening it in VS Code would run hidden code before you run anything. Free, in your browser.

Canonical: https://www.phishclean.com/tools/coding-test-checker
Last updated: 2026-11-01

Paste the repo a recruiter sent you. See whether `npm install`, starting the app or opening it in VS Code would run hidden code, before you run anything.

Runs in your browser: the repo is read straight from the code host, nothing goes to PhishClean

GitHub, GitLab and Bitbucket. Public repos only. GitHub allows about 30 checks an hour from one address.

## How fake coding tests infect developers

A recruiter reaches out on LinkedIn, Telegram or email with a well-paid role, often at a crypto or Web3 company. After a friendly chat comes the "technical step": clone this repo, run it and fix a bug, or join a video interview. The repo is a real-looking app with one extra piece that runs the moment you install or open it. North Korean groups have used this approach for years. Researchers call it Contagious Interview, and analysts suspect it in this year's largest exchange thefts. [Read how it works](https://www.phishclean.com/blog/fake-job-interview-coding-test-malware).

### What this checker reads

- **npm install hooks.** `preinstall`, `postinstall` and `prepare` scripts run by themselves. One that downloads or decodes code is the classic trap.
- **VS Code auto-run tasks.** A `.vscode/tasks.json` task with `"runOn": "folderOpen"` runs as soon as you open the folder and click Trust.
- **Files that aren't what they're named.** A script that runs `node public/fonts/fa-solid.woff2` is running code disguised as a font.
- **Code that downloads code.** `eval`, `new Function` or `Function.constructor` next to a web request, including the trick of running an error response from the attacker's server.
- **Hidden and scrambled code.** Code pushed hundreds of spaces to the right of a config line, obfuscator output, long encoded blobs, paste-site dead drops.
- **Program files.** `.exe`, `.dll`, `.dmg` or `.pkg` files committed to the repo.

### What a clean result means

Only that none of these tricks showed up in the up to 20 files it read. It does not read your dependencies' own install scripts, compiled programs or private repos, and attackers change tactics. Treat a clean result as "no known red flags", not as "safe".

### How to do a take-home test safely

- Run it in a throwaway virtual machine or a cloud dev environment (GitHub Codespaces, Gitpod), never on the laptop with your password manager, wallets, SSH keys or work VPN.
- Open unknown folders in VS Code's Restricted Mode: click "No, I don't trust the authors". That blocks tasks and extensions from running.
- Read `package.json` and `.vscode/` before anything else. Use `npm install --ignore-scripts` if you must install.
- A real employer won't mind you running their test in a sandbox. One that pushes back, rushes you or asks you to "fix your camera" with a terminal command is not a real employer.

### Already ran it?

Disconnect the computer from the internet. From a different, clean device, change your passwords (email and password manager first), move crypto to a new wallet made on a clean device, and revoke SSH keys, API tokens and cloud sessions. If it was a work laptop, tell your security team now: these attacks are after the access your job gives you. Full steps are in [the guide](https://www.phishclean.com/blog/fake-job-interview-coding-test-malware#already-ran).

### Protection while you browse

The [PhishClean extension](https://www.phishclean.com/#install) runs this check by itself when you open a repo on GitHub, GitLab or Bitbucket during the free trial and on a paid plan. It also warns, for free, when an interview page tells you to paste a "camera fix" into Terminal or the Run box.

Last updated: 1 November 2026