Alberto Arena: “I've read about this on X: they may ask you to clone a repo…”

Alberto Arena @albertoarena6d99b4834

A recruiter offered me a Laravel job up to €95k yesterday. A quick check showed it was a scam. I found on LinkedIn that the real recruiter had passed away 6 years ago. Before you reply, check who is really writing to you! ☠️

Dark card in a code font. Header: "my inbox, 22/10". Large text: "€75k–€95k". Below it: "Senior Laravel Engineer". Last line in amber: "And it was a scam."

Ivan Zugec @IvanZugec6d42ca925

I wonder what they get out of posting scam jobs? Personal data I guess.

Alberto Arena @albertoarena6d

I've read about this on X: they may ask you to clone a repo locally as a "tech assessment", and it installs malware. Never install a repo without being sure of what it is!

06:41 · Oct 23, 2026commit 3c323cf

Jordi Boggiano @Seldaek6d

Yup these started in the crypto world a few years back as they were using interviews and "please install this video conf software" to steal people's keys/wallets. It seems to have spread to the wider dev world now as a lot of people have valuable secrets/API keys on disk. Always…

Ivan Zugec @IvanZugec6d

Also, just opening the codebase using VS code is dangerous. https://github.com/microsoft/vscode/issues/280170

GitHubVSCode should warn users about tasks running automatically when opening the folder · Issue #280170 · microsoft/vscodeI got this idea from this LinkedIn post. Right now, VSCode only asks if you trust the author of the repo when you open it. A lot of people just click yes without really thinking. Since VSCode has a...

Commit