Pattern database

Scam and malicious-repo patterns to check before you trust.

Short, practical notes on the techniques scammers use across messages, recruiter outreach, and unknown codebases.

Fake Recruiter Take-Home Trap

A fake hiring conversation pushes the target to clone, install, or run a repo presented as a take-home task or broken project.

A package install hook runs before the app starts, giving malicious code a chance to read local files, tokens, or browser data.

Code decodes strings at runtime and executes them dynamically, hiding the actual behavior from a quick source review.

Executable code is split across SVG comments, decoded by startup code, and executed when a developer runs the project.

A Telegram conversation or group uses urgency, fake profits, and guaranteed returns to push the target into sending crypto.

A profile claims recruiter authority while the message avoids verifiable details and pushes the target toward unsafe next steps.