"Clone this repo and run it locally before the technical round." If you hear this in an interview, the interview is the scam. This week many devs are sharing the same story: flattering DM, real-sounding blockchain project, a rushed call, and then a repo you have to run "quickly". Some walked away. Many don't. Here's what's actually going on, and how to protect yourself 👇 ━━━━━━━━━━ 🎯 What is this attack? It's known as Contagious Interview. The fake recruiter isn't hiring. The job is only the delivery method. The repo looks like a normal take-home task, a dashboard, a DeFi app, an API. But hidden inside is code that runs when you type npm install or npm start. It quietly collects: • SSH keys • Crypto wallets and seed phrases • Browser passwords and session cookies • AWS, GitHub and npm tokens • Your .env files Then it sends everything to the attacker. No pop-up, no warning. The code "works", so you don't suspect anything. ━━━━━━━━━━ 🚩 Red flags we see again and again • Flattering first message: "your profile really impressed us" • Big salary, vague role, crypto or Web3 project • Pressure to move fast, "run it before the next round" • "Camera issues", voice-only call, or a face that glitches when you ask something unexpected • Recruiter email with random numbers: name214@gmail instead of name@company • Repo on Bitbucket or a brand-new GitHub account • postinstall or prepare scripts in package.json • Code far longer than the task needs, with the real payload hidden hundreds of lines down If you see two of these together, stop. ━━━━━━━━━━ 🛡️ Before you run any interview code • Never run it on your main laptop. Use a throwaway cloud VM or container with no credentials in it. • Read package.json first, especially the scripts section. • Search every file for URLs, base64 strings, eval, new Function and child_process. • Scan the repo before it touches your machine. That's why we built RTIdx. • Ask the company for a video call with more than one person. Real teams don't mind. ━━━━━━━━━━ 🚨 Already ran it? Don't panic, but move fast: • Disconnect that machine from the network • From a clean device, move crypto funds to a brand-new wallet • Rotate SSH keys and all API tokens: AWS, GitHub, npm, Stripe • Log out of all browser sessions and change passwords • Report the repo, so the next person gets warned ━━━━━━━━━━ 💡 Why we built Risk & Threat Index Some of us on the team were targeted by exactly these scams. One of us only escaped because he ran the "task" on a cloud instance instead of his laptop. The same repos and fake recruiter personas get reused across many victims. When one person reports it, everyone else can be warned. That's the whole idea behind RTIdx: a community threat index for recruitment scams. Paste a repo link, get a risk verdict in about 2 minutes. Free. Link in the reply 👇 #ContagiousInterview #CryptoJobScam #JobSeekerSafety

Scan any interview repo before running it: 🔗 rtidx.com From the terminal: npx @rtidx/cli check <repo-url> --context recruiter Got a suspicious repo or recruiter? Report it. It helps the next dev.

Scan any interview repo before running it: 🔗 rtidx.com From the terminal: npx @rtidx/cli check <repo-url> --context recruiter Got a suspicious repo or recruiter? Report it. It helps the next dev.

RTIdx is onsite at ARES 2026, Sweden. It’s a security conference and we are here with our paper about scams in job recruitment: „From Fake Job Offer to Full Environment Compromise: Anatomy of the Contagious Interview Campaign”