Topic starter
24/10/2026 8:52 pm
TL;DR: Fake interview lures aimed at developers have evolved into a cross-platform Go-based RAT, SStar Agent, delivered through a poisoned npm dependency hidden in a take-home assessment, with macOS and Windows samples both exfiltrating host data, according to Iru. The case shows that build-time dependency abuse can bypass conventional install-time controls and that developer workflows now sit inside the attack surface.
Editorial analysis by NHI Mgmt Group, based on content published by Iru: “Iru Quarterly Threat Report: August 2026”.
Key questions
Q: What breaks when a dependency can run code during build time?
A: Build-time execution breaks the assumption that dependencies are passive.
Q: Why do developer workstations create such a high release-risk environment?
A: Developer workstations often hold cached credentials, SSH keys, and automation secrets in one place, so a single compromise can expose multiple trust paths.
Q: What signs suggest a fake assessment is being used as malware delivery?
A: Watch for professional-looking recruitment exercises that introduce unfamiliar dependencies, build-time execution, or payloads hidden outside the main repository.
Practitioner guidance
- Harden build-time execution paths Review npm, pip, and other package workflows for scripts, hooks, and toolchain stages that execute code after installation.
- Separate assessment environments from real development access Run take-home tests, interview exercises, and sample projects in sandboxed accounts that cannot access production tokens, SSO sessions, or internal repositories.
- Monitor for campaign infrastructure, not just hashes Correlate detections for domains, deployment hashes, browser inventory access, and unusual child processes so a single malware build does not evade one-off signature logic.
Bottom line: The campaign shows that a clean repository does not prevent malware when the malicious code hides in a dependency that runs during build.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →