{"schema_version":"1.0","service":"Publicasta","type":"article","id":195,"slug":"fake_interview_git_hook_malware_developer_security_2026_07_23","title":"虚假编程面试已成为开发者安全问题","excerpt":"带有恶意代码的 take-home assignment 说明，陌生面试代码应在一次性隔离环境中运行。","language":"zh","default_language":"en","canonical_url":"https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23?lang=zh","image":{"url":"https://publicasta.com/storage/projects/9/pages/195/2026/07/c7498f0a-f7f2-4ee2-b081-fd273de6ae5f.webp","alt":"开发者笔记本在隔离沙箱中打开面试作业，密钥被保护在外部"},"publisher":{"id":9,"slug":"cybersecurity","name":"Cybersecurity Without Panic","url":"https://publicasta.com/cybersecurity"},"author":{"name":"Anton R"},"published_at":"2026-07-23T13:41:44+00:00","updated_at":"2026-07-23T13:41:44+00:00","content_markdown":"假的开发者面试现在可以看起来像普通工作。这正是它危险的地方。\n\n “招聘者”在 LinkedIn 上联系你，职位远程、薪资不错，然后发来一个 ZIP 格式的 take-home assignment。项目看起来像普通后端服务，依赖列表也不明显可疑。候选人打开代码、安装依赖、运行测试，可能还会提交 commit。Citizen Dot 7 月 23 日发布的案例中，这个熟悉流程本身就是陷阱。\n\n ![开发者笔记本在隔离沙箱中打开面试作业，密钥被保护在外部](https://publicasta.com/storage/projects/9/pages/195/2026/07/c7498f0a-f7f2-4ee2-b081-fd273de6ae5f.webp)\n\n 压缩包里带着准备好的 `.git` 目录和 hooks。`pre-commit` 会按 Linux、macOS 或 Windows 选择 payload，并安静地启动远程命令。后续阶段会下载更多脚本、安装 Node.js dependencies，并运行混淆后的 parser，迹象指向 tokens、credentials 或 wallets 窃取。\n\n Hacker News 讨论约有 408 points 和 112 comments。讨论重点不是恐慌，而是实用防护：disposable VM、devcontainers、Git hooks、VS Code Workspace Trust，以及通过官方渠道核实招聘者。\n\n ## 这不是孤立事件\n\n Proofpoint、The Hacker News、DomainTools 和 OpenSourceMalware 都报道过针对开发者的招聘诱饵活动，名称包括 Contagious Interview、Famous Chollima、Void Dokkaebi、UNK\\_DeadDrop。这个具体案例不能在没有确认时归因给某个组织，但攻击模式已经很成熟。\n\n 开发者电脑常有 SSH keys、GitHub tokens、npm/PyPI credentials、cloud sessions、`.env`、VPN、wallets 和源码。对热门开源包 maintainer 来说，一个被盗 token 就可能变成 supply-chain incident。\n\n ## 实用规则\n\n 普通 `git clone` 不会自动把远程 hooks 复制到本地 `.git/hooks`。风险更高的是带 `.git` 的 ZIP、要求 commit 的说明、`core.hooksPath`、package scripts、`.vscode/tasks.json`、launch configs 或 setup scripts。\n\n 运行前先检查 hidden files：`.git`、`.git/hooks`、`.vscode`、`.devcontainer`、`package.json`、`Makefile`、Dockerfile 和 install scripts。寻找 hooks、postinstall、远程 URL、裸 IP 和编码块。\n\n 陌生面试代码应放进你自己控制的 disposable VM 或 devcontainer。不要挂载 home、SSH keys、浏览器配置、password manager、真实 tokens 或 `.env`。如果已经运行了可疑项目，应撤销 sessions、轮换 credentials；如果机器有工作访问权限，要尽快通知 security team。","available_translations":[{"language":"ar","title":"مقابلات البرمجة المزيفة أصبحت مشكلة أمنية للمطورين","html_url":"https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23?lang=ar","markdown_url":"https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23.md?lang=ar","json_url":"https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23.json?lang=ar","api_url":"https://publicasta.com/api/public/v1/channels/cybersecurity/articles/fake_interview_git_hook_malware_developer_security_2026_07_23?lang=ar"},{"language":"de","title":"Gefälschte Coding-Interviews werden zum Sicherheitsproblem für Entwickler","html_url":"https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23?lang=de","markdown_url":"https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23.md?lang=de","json_url":"https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23.json?lang=de","api_url":"https://publicasta.com/api/public/v1/channels/cybersecurity/articles/fake_interview_git_hook_malware_developer_security_2026_07_23?lang=de"},{"language":"en","title":"Fake coding interviews are now a developer security problem","html_url":"https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23?lang=en","markdown_url":"https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23.md?lang=en","json_url":"https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23.json?lang=en","api_url":"https://publicasta.com/api/public/v1/channels/cybersecurity/articles/fake_interview_git_hook_malware_developer_security_2026_07_23?lang=en"},{"language":"es","title":"Las entrevistas técnicas falsas ya son un problema de seguridad para desarrolladores","html_url":"https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23?lang=es","markdown_url":"https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23.md?lang=es","json_url":"https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23.json?lang=es","api_url":"https://publicasta.com/api/public/v1/channels/cybersecurity/articles/fake_interview_git_hook_malware_developer_security_2026_07_23?lang=es"},{"language":"fr","title":"Les fausses interviews techniques deviennent un risque sécurité pour les développeurs","html_url":"https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23?lang=fr","markdown_url":"https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23.md?lang=fr","json_url":"https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23.json?lang=fr","api_url":"https://publicasta.com/api/public/v1/channels/cybersecurity/articles/fake_interview_git_hook_malware_developer_security_2026_07_23?lang=fr"},{"language":"pl","title":"Fałszywe rozmowy techniczne stały się problemem bezpieczeństwa deweloperów","html_url":"https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23?lang=pl","markdown_url":"https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23.md?lang=pl","json_url":"https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23.json?lang=pl","api_url":"https://publicasta.com/api/public/v1/channels/cybersecurity/articles/fake_interview_git_hook_malware_developer_security_2026_07_23?lang=pl"},{"language":"ru","title":"Фальшивые coding interviews стали проблемой безопасности разработчиков","html_url":"https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23?lang=ru","markdown_url":"https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23.md?lang=ru","json_url":"https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23.json?lang=ru","api_url":"https://publicasta.com/api/public/v1/channels/cybersecurity/articles/fake_interview_git_hook_malware_developer_security_2026_07_23?lang=ru"},{"language":"zh","title":"虚假编程面试已成为开发者安全问题","html_url":"https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23?lang=zh","markdown_url":"https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23.md?lang=zh","json_url":"https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23.json?lang=zh","api_url":"https://publicasta.com/api/public/v1/channels/cybersecurity/articles/fake_interview_git_hook_malware_developer_security_2026_07_23?lang=zh"}],"_links":{"self":"https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23.json?lang=zh","api":"https://publicasta.com/api/public/v1/channels/cybersecurity/articles/fake_interview_git_hook_malware_developer_security_2026_07_23?lang=zh","html":"https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23?lang=zh","canonical":"https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23?lang=zh","markdown":"https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23.md?lang=zh","json":"https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23.json?lang=zh","channel":"https://publicasta.com/api/public/v1/channels/cybersecurity","channel_articles":"https://publicasta.com/api/public/v1/channels/cybersecurity/articles","search":"https://publicasta.com/api/public/v1/search","documentation":"https://publicasta.com/api-docs#reading-publicasta","openapi":"https://publicasta.com/api-docs/openapi.json","llms":"https://publicasta.com/llms.txt"}}