OpenSourceMalware Flags Private Repositories in Crypto Hiring

OpenSourceMalware described a crypto hiring campaign that sends LinkedIn candidates to private code repositories, where package settings may run malicious code during installation, in an Oct. 21 disclosure. The security platform characterized the activity as North Korea-linked and part of Contagious Interview. Candidates receive a development task that requires installing software packages. A .npmrc file in the repository directs npm to fetch dependencies from a specified external package registry instead of the public registry. That setup may run malicious code during installation and make the activity less likely to appear in public security scans. Attackers have recently used the technique.