{"rewrite":{"id":"r_fc7aff93629541c0adb752ad","clusterId":"c_e8055c18b220d1bc8794d4de","slug":"a-backdoor-disguised-as-a-job-offer-targets-a-security-engineer","model":"deepseek-v4-flash","headline":"A Backdoor Disguised as a Job Offer Targets a Security Engineer","summary":"Full-stack engineer Roman Imankulov was contacted on LinkedIn by someone claiming to recruit for a cryptocurrency startup. The recruiter sent a GitHub repository to review. Imankulov used an AI agent to inspect the code, which found a backdoor that would execute remote code on 'npm install'. The recruiter's profile was stolen from a real art journalist, and the repository's commit history was hijacked from another developer.","whyItMatters":"The attack shows how job seekers in tech can be targeted with malicious code disguised as a routine pre-hire review, and that even security-aware engineers can be caught off guard.","webCardHtml":"\u003cp\u003eIn early June 2026, Roman Imankulov received a LinkedIn message from someone claiming to recruit for a small cryptocurrency startup. After a few exchanges, the recruiter sent a GitHub repository and asked him to check a Node module issue. Imankulov, a full-stack engineer, had reviewed code for prospective employers before, but something felt wrong.\u003c/p\u003e\u003cp\u003eHe ran an AI agent tool on a disposable virtual private server with instructions to report any suspicious parts. The tool found that the repository contained a backdoor that would execute code from an external server just by running \u0026#39;npm install\u0026#39;. The repository\u0026#39;s commit logs showed signs of real development, but the person whose name was on those commits told Imankulov they had been a victim of a GitHub repository hijacking and did not remember committing to that repo.\u003c/p\u003e\u003cp\u003eThe recruiter\u0026#39;s LinkedIn profile belonged to a real art journalist who had no background in software technology, yet the recruiter sent technical messages like \u0026#39;Try installing with npm instead of pnpm.\u0026#39; Imankulov said he was aware of this type of attack but was still caught off guard when it happened to him.\u003c/p\u003e","blueskyPost":"A security engineer was sent a GitHub repo with a backdoor disguised as a job code review. The recruiter's profile was stolen from an art journalist. The attack would have run remote code on 'npm install'.","twitterPost":"A security engineer was sent a GitHub repo with a backdoor disguised as a job code review. The recruiter's profile was stolen from an art journalist. The attack would have run remote code on 'npm install'.","threadsPost":null,"newsletterBlurb":"Full-stack engineer Roman Imankulov was contacted on LinkedIn by someone claiming to recruit for a cryptocurrency startup. The recruiter sent a GitHub repository to review, which contained a backdoor that would execute remote code on 'npm install'. The recruiter's profile was stolen from a real art journalist.","attributionJson":"[{\"source\":\"GIGAZINE\",\"url\":\"https://gigazine.net/news/20260616-backdoor-job-offer/\",\"title\":\"A personal account of being sent a GitHub repository with a backdoor disguised as a job offer\"}]","lintFlagsJson":null,"lintHits":0,"costUsd":0,"inputTokens":4182,"outputTokens":649,"status":"published","repairAttempts":0,"nextRepairAt":null,"factsAttemptedAt":1781610841,"createdAt":"2026-06-16T11:46:42.000Z","publishedAt":"2026-06-16T11:49:57.000Z","updatedAt":"2026-06-16T11:49:57.000Z"},"cluster":{"id":"c_e8055c18b220d1bc8794d4de","canonicalTitle":"求人オファーに見せかけて「バックドアを仕込んだGitHubリポジトリ」を送りつけられたという体験談","representativeArticleId":"a_9d0af8a125544cb1b9161ab7","sourceCount":1,"writtenSourceCount":1,"writeAttempts":0,"isSolo":true,"entitiesJson":"{\"anime_titles\":[],\"manga_titles\":[],\"work_titles\":[],\"studios\":[],\"people\":[\"Roman Imankulov\"],\"type\":\"news\",\"domain\":\"other\",\"is_roundup\":false}","contentType":"news","status":"published","firstSeenAt":"2026-06-16T11:00:00.000Z","lastSeenAt":"2026-06-16T11:00:00.000Z","updatedAt":"2026-06-16T11:49:58.000Z"},"attribution":[{"source":"GIGAZINE","url":"https://gigazine.net/news/20260616-backdoor-job-offer/","title":"求人オファーに見せかけて「バックドアを仕込んだGitHubリポジトリ」を送りつけられたという体験談"}],"entities":{"anime_titles":[],"manga_titles":[],"work_titles":[],"studios":[],"people":["Roman Imankulov"],"type":"news","domain":"other","is_roundup":false},"keyFacts":["In early June 2026, full-stack engineer Roman Imankulov received a LinkedIn message from someone claiming to recruit for a small cryptocurrency startup.","The recruiter sent a GitHub repository for review; an AI agent tool found a backdoor that would execute remote code on 'npm install'.","The recruiter's LinkedIn profile was stolen from a real art journalist with no software background, and the repository's commit history was hijacked from another developer.","Imankulov said he was aware of this type of attack but was still caught off guard when it happened to him."]}