--- service: "Publicasta" schema_version: "1.0" article_id: 195 title: "虚假编程面试已成为开发者安全问题" language: "zh" default_language: "en" canonical_url: "https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23?lang=zh" json_url: "https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23.json?lang=zh" api_url: "https://publicasta.com/api/public/v1/channels/cybersecurity/articles/fake_interview_git_hook_malware_developer_security_2026_07_23?lang=zh" channel_url: "https://publicasta.com/api/public/v1/channels/cybersecurity" channel_articles: "https://publicasta.com/api/public/v1/channels/cybersecurity/articles" search_url: "https://publicasta.com/api/public/v1/search" documentation_url: "https://publicasta.com/api-docs#reading-publicasta" openapi_url: "https://publicasta.com/api-docs/openapi.json" published_at: "2026-07-23T13:41:44+00:00" updated_at: "2026-07-23T13:41:44+00:00" translations: - language: "ar" html_url: "https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23?lang=ar" markdown_url: "https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23.md?lang=ar" json_url: "https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23.json?lang=ar" - language: "de" html_url: "https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23?lang=de" markdown_url: "https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23.md?lang=de" json_url: "https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23.json?lang=de" - language: "en" html_url: "https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23?lang=en" markdown_url: "https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23.md?lang=en" json_url: "https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23.json?lang=en" - language: "es" html_url: "https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23?lang=es" markdown_url: "https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23.md?lang=es" json_url: "https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23.json?lang=es" - language: "fr" html_url: "https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23?lang=fr" markdown_url: "https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23.md?lang=fr" json_url: "https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23.json?lang=fr" - language: "pl" html_url: "https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23?lang=pl" markdown_url: "https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23.md?lang=pl" json_url: "https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23.json?lang=pl" - language: "ru" html_url: "https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23?lang=ru" markdown_url: "https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23.md?lang=ru" json_url: "https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23.json?lang=ru" - language: "zh" html_url: "https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23?lang=zh" markdown_url: "https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23.md?lang=zh" json_url: "https://publicasta.com/cybersecurity/fake_interview_git_hook_malware_developer_security_2026_07_23.json?lang=zh" --- # 虚假编程面试已成为开发者安全问题 > 带有恶意代码的 take-home assignment 说明，陌生面试代码应在一次性隔离环境中运行。 假的开发者面试现在可以看起来像普通工作。这正是它危险的地方。 “招聘者”在 LinkedIn 上联系你，职位远程、薪资不错，然后发来一个 ZIP 格式的 take-home assignment。项目看起来像普通后端服务，依赖列表也不明显可疑。候选人打开代码、安装依赖、运行测试，可能还会提交 commit。Citizen Dot 7 月 23 日发布的案例中，这个熟悉流程本身就是陷阱。 ![开发者笔记本在隔离沙箱中打开面试作业，密钥被保护在外部](https://publicasta.com/storage/projects/9/pages/195/2026/07/c7498f0a-f7f2-4ee2-b081-fd273de6ae5f.webp) 压缩包里带着准备好的 `.git` 目录和 hooks。`pre-commit` 会按 Linux、macOS 或 Windows 选择 payload，并安静地启动远程命令。后续阶段会下载更多脚本、安装 Node.js dependencies，并运行混淆后的 parser，迹象指向 tokens、credentials 或 wallets 窃取。 Hacker News 讨论约有 408 points 和 112 comments。讨论重点不是恐慌，而是实用防护：disposable VM、devcontainers、Git hooks、VS Code Workspace Trust，以及通过官方渠道核实招聘者。 ## 这不是孤立事件 Proofpoint、The Hacker News、DomainTools 和 OpenSourceMalware 都报道过针对开发者的招聘诱饵活动，名称包括 Contagious Interview、Famous Chollima、Void Dokkaebi、UNK\_DeadDrop。这个具体案例不能在没有确认时归因给某个组织，但攻击模式已经很成熟。 开发者电脑常有 SSH keys、GitHub tokens、npm/PyPI credentials、cloud sessions、`.env`、VPN、wallets 和源码。对热门开源包 maintainer 来说，一个被盗 token 就可能变成 supply-chain incident。 ## 实用规则 普通 `git clone` 不会自动把远程 hooks 复制到本地 `.git/hooks`。风险更高的是带 `.git` 的 ZIP、要求 commit 的说明、`core.hooksPath`、package scripts、`.vscode/tasks.json`、launch configs 或 setup scripts。 运行前先检查 hidden files：`.git`、`.git/hooks`、`.vscode`、`.devcontainer`、`package.json`、`Makefile`、Dockerfile 和 install scripts。寻找 hooks、postinstall、远程 URL、裸 IP 和编码块。 陌生面试代码应放进你自己控制的 disposable VM 或 devcontainer。不要挂载 home、SSH keys、浏览器配置、password manager、真实 tokens 或 `.env`。如果已经运行了可疑项目，应撤销 sessions、轮换 credentials；如果机器有工作访问权限，要尽快通知 security team。