Hacken: There are scammers posing as project parties to induce developers and auditors to download suspicious repositories. Please be aware of the ri

Blockchain security organization Hacken has recently discovered a scam that has emerged on platforms such as Telegram and Linkedin. It is worth noting that this scam targets developers and auditors in the cryptocurrency industry.

Specifically, scammers on social networks specifically target individuals who provide technical services, convincing them to download a repository in the name of a legitimate project. In the repository, there is an unstable "npm run" command in the code. When executed, it may jeopardize the user's file system. This method is similar to previous scams involving fraudulent zip files and PDFs.

To strengthen defense against this strategy, consider the following measures:

- Be cautious when downloading repositories, especially when prompted by unfamiliar sources;

- Carefully check repository code using tools such as Semgrep or CodeQL and establish defined rules to ensure its safety when executed locally.