BuildNot yet confirmed elsewhere1 publisher2 min readPublished
A fake recruiter's take-home ships an npm token that unlocks a package the public registry 404s
A developer says a fake-recruiter take-home bundled an npm token to fetch a hidden package, in a scheme a government advisory counts at 30,000+ machines. The author ran nothing and never read the hidden package, so its payload is inferred from structure.
The Engineer · Build desk
Key figures: over 338 malicious npm packages tied to fake-interview lures since July 2025, per Socket researchers; one November 2025 wave added 197 packages; the packages were downloaded over 50,000 times.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Lure packages since July 2025, per Socket, over | 338 packages | 15 | |
| Added in November 2025 wave | 197 packages | 16 | |
| Their downloads, over | 50,000 downloads | 15 |
What happened
- The Carmlize 'recruiter' hired the author over Slack without an interview and sent a GitHub repo link with instructions to clone it and get it running.
- The UK business registry listed Carmlize at a shared virtual-office address that hundreds of unrelated companies use.
- The repo was a Next.js crypto dashboard with a swap screen, an order matching engine and a Solidity token contract, and the author found nothing malicious in the code itself.
- The dev dependency animatecss-tailwind-adapter was first published on 2026-07-28, and 2.0.6 is the only version that has ever existed.
- Socket researchers have tied 338+ malicious npm packages to fake-interview lures since July 2025, with 50,000+ downloads, the post says.
Why it matters
- decision Where an assessment runs has to be settled before the first command. A machine that holds credentials is the wrong place for either of the two execution points in the post's chain.
- constraint A reviewer without the token cannot inspect what the install would run, so due diligence on this chain stops at registry metadata and the repo's visible source.
- contradiction The 30,000-machine count and the 338-package count are different measures from different sources, so neither can stand in for the other or be read as cause and effect on this evidence.
The post's author sums up the design in one sentence: "The bad stuff isn't in the repo; it's in what the repo pulls in." [19] The enabling piece is an npm auth token shipped in the repo's .npmrc. With it in place, npm install logs in to the registry as someone else and can download packages the public cannot see [6]. The Tailwind config requires animatecss-tailwind-adapter [7], and that adapter depends on a scoped package, @aaron205whitmore/postcss-animate-utils [10]. Per the post, that package can only be fetched with credentials like the bundled token [11].
By the post's account, package code runs at two points. On npm install, the token pulls the hidden package and its install scripts run straight away. On npm run dev, Tailwind loads the config that requires the adapter [18]. The post's account stops at that step, short of the payload. A defence that blocks only install scripts would cover the first trigger and leave the second.
The case for hostility is structural. The adapter's maintainer account did not match the GitHub repo or the author name [9]. The package began at version 2, which the author calls "a classic way to look established" [20]. The task brief, FULLSTACK_DEVELOPER.md, says "No Solidity, no RPC work" while the repo is full of exactly that [5]. Each point is circumstantial, and together they support a strong inference about a package nobody in the post has opened.
The headline figures come from two sources. The post credits the 30,000-machine, 100-country count to the joint advisory [13] and the 338-package count to researchers at Socket [15]. The post did not disclose whether the packages account for the machines, or name the advisory or the agencies behind it. One wave in November 2025 added 197 packages [16]. Against 338 that is at most about 58% [12], since 338+ is a floor. The post also dates a 35-package wave to June 2025 [17] and Socket's count to July 2025 [15], so it is unclear whether those 35 are among the 338. The 7,000-wallet and $10.7 million figures sit unsourced in the same list [14].
In our view the rule should rest on the chain. Carmlize's warning signs were a hire with no interview, a shared virtual-office address and LinkedIn profiles with about one post each [c1, c7, c8]. A better-staffed fake company could clear those checks while still shipping a private package fetched with a bundled token.
What to watch
- Whether the advisory's own text ties the 338 npm packages to the 30,000-machine count, since the post attributes the two figures to different sources.
- Whether Socket or npm publishes an analysis of @aaron205whitmore/postcss-animate-utils, the one piece of the chain the post never read.
- Whether animatecss-tailwind-adapter, first published on 2026-07-28, is pulled from the public registry.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence42
- Adoption
- Insufficient
- Hype gap+20
- Incentives
- Insufficient
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
A 'recruiter' from a company called Carmlize added the post's author to a Slack workspace, hired them without an interview, and sent a GitHub repo link with the instruction to clone it and get it running.
- [2]
The UK business registry listed Carmlize at a shared virtual-office address that hundreds of unrelated companies use.
- [3]
The people listed as Carmlize employees on LinkedIn each had about one post, thin work histories and almost no activity.
- [4]
The repo was a Next.js crypto dashboard with live markets, a swap screen, an order matching engine, wallet connect and a small Solidity token contract, and the author found nothing nasty in the code itself.
- [5]
The task brief (FULLSTACK_DEVELOPER.md) says "No Solidity, no RPC work" while the repo is full of exactly that.
- [6]
The repo ships an .npmrc line with an npm auth token (redacted in the post); with that file in place, npm install logs in to the npm registry as someone else and can download packages the public cannot see.
- [7]
package.json lists a dev dependency called animatecss-tailwind-adapter, and the Tailwind config loads it with require().
- [8]
animatecss-tailwind-adapter was first published on 2026-07-28, and the only version that has ever existed is 2.0.6.
- [9]
The adapter's maintainer account did not match the GitHub repo or author name in the package.
- [10]
The adapter depends on a scoped package called @aaron205whitmore/postcss-animate-utils.
- [11]
The public registry returned a 404 for @aaron205whitmore/postcss-animate-utils; the author could not see, download or read it, and says it can only be obtained with the right credentials, like the token in .npmrc.
- [12]
The November 2025 wave of 197 packages is at most about 58% of the 338+ packages Socket counted.
- [13]
The author says a joint government cybersecurity advisory describes fake job interviews that compromised more than 30,000 machines in over 100 countries in about eight months.
ReportedInsufficientSource: Post's author, paraphrasing an unnamed joint government advisoryView cited source - [14]
The post's list also states 7,000+ crypto wallets hit, with roughly $10.7 million stolen, without naming a source for the figure.
- [15]
Researchers at Socket have found 338+ malicious npm packages tied to fake-interview lures since July 2025, downloaded 50,000+ times.
- [16]
One wave in November 2025 added 197 packages and 31,000+ downloads.
- [17]
Another wave in June 2025 used 24 different npm accounts to publish 35 packages, and many were pulled before anyone could count them properly.
- [18]
By the author's account, npm install uses the bundled token, downloads the hidden package and runs any install scripts in it straight away; npm run dev then has Tailwind load the config that requires the adapter. The post's text breaks off at that step.
- [19]
"The bad stuff isn't in the repo; it's in what the repo pulls in."
- [20]
The author writes that a brand-new package starting at version 2 is "a classic way to look established".
Sources
1 independent publisher whose own reporting we read for this story.
- dev.to30,000 Machines Hacked by Fake Job Offers. Mine Was Almost Next.
1 article · October 13, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Developer securityFollow
- Fake recruiter scamsFollow
- npm Supply-Chain SecurityFollow