Developer Discovers Take-Home Interview Project Was Disguised Malware Operation

·1 views

A developer shared findings after inspecting a take-home coding assignment received during a job interview process. Upon closer examination, the project contained hidden malicious code, suggesting the 'interview' was a cover to deliver malware. The scheme reportedly used Git hooks or similar mechanisms to execute harmful scripts on the candidate's machine. The incident highlights a growing tactic where bad actors pose as employers to compromise developers' systems. The full technical breakdown was published on the developer's personal blog.

Read the full story at Hacker News

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why budgeting apps show wrong historical totals in multi-currency finance

A developer building a multi-currency personal finance app has identified a widespread flaw in how such apps handle historical transactions. The problem occurs when apps apply today's live exchange rate to past transactions, effectively rewriting financial history and producing inaccurate totals. The correct approach is to snapshot the exchange rate at the time of each transaction, freezing it as a historical fact rather than recalculating it dynamically. For current balances, live rates remain appropriate, but past records should rely on the rate that was in effect on the transaction's value date. The developer recommends storing the original currency, amount, date, and historical rate together to ensure accurate reporting and flexibility if a user later changes their base currency.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Solo Dev's Anti-Theft Token Logic Locked Out All Users Due to Replay Edge Cases

A solo developer building a finance app discovered that its OWASP-recommended refresh token reuse detection was incorrectly flagging legitimate same-device token replays as theft attempts, locking out all users. The flaw stemmed from three benign scenarios: dropped network connections causing clients to retry already-rotated tokens, failed keychain writes leaving apps with stale tokens, and race conditions between the main app and its widget extension both refreshing simultaneously. Because the security logic treated any revoked-token replay as theft and revoked all sessions, real users were repeatedly signed out despite no actual attack occurring. The developer's fix introduced device ID binding to distinguish same-device replays from genuinely suspicious cross-device reuse, reserving the full session wipe only for the latter. Supporting changes included a cross-process refresh mutex, hardened keychain write handling, and ensuring transient network failures never result in forced logouts.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Build a Free n8n Workflow to Get FOMC and CPI Alerts on Telegram

A developer has shared a step-by-step guide for building an automated economic calendar alert system using n8n, a free Apify actor, and Telegram. The workflow polls a ForexFactory-based economic calendar every weekday morning and sends notifications for high-impact USD events such as FOMC decisions, CPI prints, and NFP releases. The author notes the solution addresses common pain points like manual checking, unreliable scraping, and the cost of commercial calendar APIs, which typically start at $30–100 per month. The entire setup runs on free tiers of n8n and Apify, requires no self-hosted infrastructure beyond an optional Docker instance, and takes roughly 15 minutes to configure. The author discloses they built the Apify actor used in the tutorial, flagging a potential conflict of interest.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer finds 20+ hidden bugs in Rust framework by translating code into UML diagrams

A developer auditing their own Rust web framework, Runique v2.1.21, discovered over 20 latent bugs — including three security-relevant ones — by systematically translating the codebase into UML and Merise diagrams. The bugs had gone undetected by the Rust compiler, automated tests, and runtime tracing tools, highlighting the limits of local, per-function analysis. The approach was inspired by reading a design patterns book, where the developer noticed that UML class diagrams and Rust's type system encode the same structural information in different notations. By treating the translation between the two as nearly mechanical, any mismatch between the diagram and the code revealed a potential defect hiding in the gap. The developer used AI assistant Claude to help verify each translation against the actual source code line by line.

0 comments Read more at DEV Community