From Fake Job Offer to Full Environment Compromise

This paper presents a comparative static analysis of six trojanized npm repositories linked to the “Contagious Interview” campaign: a sustained operation targeting software engineers through fabricated job offers. Each repository was submitted independently to the analysis platform and analyzed using rule-based static scanning without code execution. The analysis reveals a shared malware framework with three invariant components: (1) automatic execution via npm lifecycle hooks, (2) full process.env exfiltration to attacker-controlled Command and Control servers, and (3) Remote Code Execution through dynamic function construction. Despite this technical uniformity, the campaign employs diverse social engineering “skins”, from DeFi platforms to World Cup NFT games, which suggests a deliberate strategy to target different developer personas. The findings have implications for software supply chain security, recruitment practices in the tech industry, and the development of automated malware detection heuristics.