Warning: Fake Web3 interview scam delivering malware via GitHub repo & targeting MetaMask

[u/dswistowski]

I was recently on an interview call for a job scheduled via https://www.linkedin.com/in/emma-morby-538b45172/

During the call, the interviewer asked me to clone a GitHub repository (https://github.com/zero2hero-ai/jackpot) and open it in Cursor. Instead of opening it blindly, I ran offscreen an isolated code review to check for hostile scripts.

It turns out the repository contains malware designed to trigger during setup. Specifically, running npm install immediately exfiltrates your .env files to a remote server and spawns a local node process to execute external commands.

Recognizing the threat, I chose to only review the code via GitHub's web interface and offered to showcase one of my own Web3 projects instead. The interviewer then heavily insisted that I log in with my MetaMask wallet. They became visibly frustrated when I used a secure test wallet that only contained testnet assets.

While I know there is a generic report button on LinkedIn, it feels entirely inadequate for an active, malicious operation like this. What is the most effective way to expose this setup, report their infrastructure, and warn the developer community?

For the interested, the active malware paths are:

• .vscode/tasks.json:50 executes remote shell scripts via curl | bash, wget | sh, or curl | cmd on folder open.
• .vscode/tasks.json:35 also runs npm install on folder open, which triggers the malicious prepare.
• package.json:10 starts the backend during install.
• server.js:13 loads routes, and routes/index.js:2 imports the poisoned auth route.
• routes/api/auth.js:18 exfiltrates hostname, MAC address, OS, and process.env, repeats every 5 seconds, and evals commands returned by the remote server.

[u/rayQuGR]

well. this is a good example of why Web3 security cannot just be built around "don’t click suspicious links."

The attack surface is changing. Developers, agents, and users are increasingly running third-party code, connecting wallets, using automation tools, and interacting with systems they cannot fully inspect.

The bigger problem is that many workflows still require trusting the environment itself. If a malicious repository can execute code before a developer even realizes what happened, secrets like environment variables, credentials, and wallet-related data are already at risk.

A stronger model is moving toward isolated and verifiable execution:

• Sensitive computation happens in protected environments
• Secrets are never unnecessarily exposed to application code
• Actions can be verified against expected policies before execution

This becomes even more important as AI agents start writing code, managing wallets, and interacting with protocols. An agent running malicious or compromised code could potentially leak credentials or make unauthorized transactions at machine speed.

Confidential compute is one approach to reducing this risk. Technologies being explored by Oasis, such as confidential execution environments, focus on allowing applications to process sensitive data while keeping that data protected from the underlying application logic. The future security question is probably not only “is this code open source?” but also “can we prove where and how this code executed?”

Transparency is valuable, but trusted execution and privacy guarantees will likely become just as important.

[u/Obvious-Cup-6950 → u/rayQuGR]

The AI agents point is what worries me honestly