Developer warns: reading a client's repo, not running it, exposed a likely crypto scam

·1 views

A software developer received a request from a prospective client to clone their repository, run it locally, and share a screenshot of the landing page ahead of a call. Recognising that executing unknown code risked exposing wallet keys, API tokens, and active browser sessions via malicious install hooks, the developer chose to read the codebase remotely instead. A forty-minute manual review revealed serious red flags: smart contracts that either burned user deposits or allowed anyone to drain unlimited rewards, a frontend containing assets from an unrelated real product, and a generic e-commerce backend with no connection to the claimed decentralised exchange. The repository had a single commit with no development history, and a tracked .env file ready to capture credentials. The developer identified the approach as a well-documented fake-recruiter attack pattern and advised others to read unfamiliar repositories rather than execute them.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Pandora Now Officially Supports Google Gemini Voice Control for Music Playback

Pandora has officially added Google Gemini to its list of supported devices and partners, enabling users to control Pandora playback through Gemini voice requests on compatible devices. Google's own Gemini for Home documentation independently confirms Pandora as a supported media service, validating the integration from both sides. The feature allows listeners to ask Gemini to play Pandora music, playlists, or mood-based content without manually opening the app. The integration also extends an existing relationship between the two companies, with Pandora able to serve as a primary music provider on Google Home. The documented support reflects a consumer-facing interoperability layer rather than a new standalone product or developer platform.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Fever's Event Catalog Highlights Challenges of AI-Powered Ticket Discovery

Fever, a consumer platform for discovering and booking local experiences, represents the type of service that could benefit from conversational AI integration, allowing users to find events through natural-language requests rather than manual filters. A useful AI-to-ticketing connection would need to handle real-time availability, inventory changes, location data, user consent, and a seamless handoff from recommendation to booking. Google's Gemini developer resources do describe frameworks for connecting third-party apps and services, but neither Google nor Fever has publicly confirmed a direct Gemini-Fever integration. The distinction is significant, as general integration documentation does not establish a specific partnership between the two companies. Key unresolved questions for any such integration would include catalog scope, data freshness, user privacy, booking flow, and commercial arrangements between the platforms.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Detect and Prevent Infrastructure Drift in Terraform Environments

Infrastructure-as-code (IaC) tools like Terraform can fall out of sync with actual infrastructure when engineers make manual changes outside the declared configuration, a problem known as drift. Such divergence can cause configuration inconsistencies, security vulnerabilities, and service outages if left unaddressed. Terraform's built-in state commands, as well as third-party tools like Terragrunt and Terraform Compliance, can be used to automatically compare declared and actual infrastructure states. Experts recommend running automated drift detection daily and treating any discrepancy as a failing test. Establishing a culture where all changes flow through IaC configurations, supported by documentation and automated validation, is key to preventing drift from occurring.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How a Single Zod Schema Can Validate, Type, and Repair AI Model Outputs

A common failure point in AI-powered applications is the gap between a raw string returned by a model and the structured object a UI component expects. Using a single Zod schema can address this by serving simultaneously as a runtime validator, a compile-time TypeScript type, a JSON Schema constraint sent to the model, and a source of structured error messages for repair prompts. Zod 4 includes a built-in z.toJSONSchema() method, while Zod 3 users must rely on the separate zod-to-json-schema package, making version awareness important. When constrained decoding against a schema is supported by a provider, the article recommends using it to make malformed JSON structurally impossible rather than just unlikely. For cases where strict output constraints are unavailable, the approach distinguishes between two distinct failure modes — non-JSON responses and schema mismatches — so that repair instructions sent back to the model are accurate and targeted.

0 comments Read more at DEV Community