Fake company uses coding test to install…

HighSupply chainExploitation confirmedFix unconfirmed

In 30 seconds

Alleged

Two alleged malware packages posing as Tailwind plugins have been removed from npm after reportedly remaining available for about five and seven months. IntCyberDigest says a supposed company called AccuraSoftHire used them in a take-home coding test aimed at job applicants, but the supplied evidence does not independently verify the campaign or identify the packages.

What happened

Alleged

According to IntCyberDigest, the operation began with job advertisements on Indeed and Glassdoor and recruiters displaying identity-verified badges on LinkedIn. Applicants were allegedly given a coding exercise designed to load look-alike Tailwind plugins from npm, which then planted malware on their computers.

Why it matters

Inferred

If the account is accurate, the campaign combined familiar hiring signals with a routine developer workflow, making the malicious step resemble ordinary package installation. The reported months-long availability of the packages also suggests that multiple applicants could have encountered them before removal, although no victim count is provided.

What to do

Inferred

Developers receiving take-home tests should treat package installation as a security-sensitive action: inspect dependency names and code, avoid running unfamiliar projects on a primary machine, and use an isolated environment without browser sessions, wallets, SSH keys or cloud credentials. These precautions follow from the types of data the alleged malware targeted and are not quoted guidance from the source.

Confirmed and still uncertain

Observed

The supplied item reports a company name, distribution route, targeted data and approximate time on npm. It does not provide package names, registry records, malware samples, indicators of compromise, victim totals, campaign dates or direct evidence connecting the job listings, recruiters and packages to one operator.

What people are saying

Alleged

IntCyberDigest attributes the finding to StepSecurity and says the two packages stayed on npm for roughly five and seven months before removal. The evidence batch contains neither StepSecurity's original analysis nor an npm statement, so that attribution remains secondhand here.

Evolution

Alleged

The reported sequence is straightforward: job advertisements attracted candidates, apparently verified LinkedIn recruiters added credibility, a take-home test directed applicants toward look-alike npm plugins, and those packages allegedly installed credential-stealing malware. The packages were later removed after periods reported as approximately five and seven months.

Reach

Observed

1 independent groups, 1 updates, and 14 engagements.

Technical detail

Alleged

The malware allegedly searched for browser logins, cryptocurrency wallets, SSH keys and cloud credentials. IntCyberDigest also says it obtained its server address from an Ethereum wallet, a technique that could let an operator publish connection information through blockchain data, but the supplied evidence includes no code or transaction details to verify the mechanism.

Sources and evidence

Observed

This report is based on one IntCyberDigest post on X, which includes an HTTPS-hosted image and cites StepSecurity without supplying the underlying report. It is useful as an alert, but by itself it cannot confirm the supposed company's identity, the package history, the malware's behavior or whether any applicants were compromised.