A Developer Got a Fake Job Offer. An AI Agent Caught the Backdoor Hiding Inside It.
A security researcher recently got an email that looked like a dream opportunity: a Singapore-based VC firm wanted to interview them, and the "technical screen" was a small TypeScript repo to review. Standard stuff, on the surface. Except the firm didn't really exist, the recruiter's LinkedIn profile was hollow, and the repo was carrying a live backdoor.
Here's how it almost worked — and the part that actually stopped it.
The Bait
The email impersonated a VC called "Lua Ventures." It came with all the trimmings of a real recruiting pitch: a polished pretext, a sense of urgency, and a coding exercise that asked the researcher to clone a repository and run the install.
This is a known playbook. Fake recruiters targeting developers with malicious "take-home tests" has been a recurring tactic for state-linked threat actors going after engineers with access to valuable codebases — in this case, someone who maintains packages on crates.io, the Rust package registry.
Where the Backdoor Was Hiding
Instead of just running the install like the email wanted, the researcher handed the repository to an AI agent — specifically Claude — to scan it first.
That scan is what found it. Buried inside a file called typescript+5.9.2.patch was a base64-obfuscated payload. It looked like a routine dependency patch, the kind of file most people would never think to open by hand. But the moment patch-package applied it during install, it would silently drop two files — payload.js and mutex.js — into a hidden cache directory on the machine.
That combination is now being tracked as a backdoor with the name PinpinRAT. It's a remote-access tool, built to slip in quietly during a process developers run dozens of times a day without a second thought: installing dependencies.
Why This One Stands Out
A few things make this case worth paying attention to:
- The target was deliberate. This wasn't spray-and-pray phishing. The attacker built a fake identity, a fake company, and a fake hiring process specifically aimed at someone with publishing access to a real package registry.
- The payload was hidden in plain sight. A patch file is exactly the kind of artifact that gets glossed over in a manual code review — it's expected to be noisy, mechanical, and boring. That's precisely why it was chosen.
- It was caught by automated review, not human eyeballs. The researcher didn't spot the obfuscated payload themselves. An AI agent scanning the repo line by line did.
The findings have since been reported to national cybersecurity authorities, including Canada's CCCS, as part of the broader effort to track and disrupt the campaign.
The Bigger Pattern: Supply Chain Attacks Are Getting More Personal
Software supply chain attacks used to mean compromising a popular package and waiting for thousands of downstream projects to pull it in automatically. This is a more targeted variant — go after one specific maintainer, with a custom-built social engineering pretext, to get a backdoor planted at the source.
It's a sign that as defenses against generic supply chain attacks improve, attackers are willing to invest more effort per target. A fake VC, a fake interview, a custom patch file — that's a lot of setup for one developer's machine.
What This Means If You Use OpenClaw
This story is a clean example of something OpenClaw is built around: having an agent actually look at the code you're about to run, not just trust that it's safe because it came packaged as a "patch" or a "dependency."
Most developers don't manually audit every patch file, every install script, every base64 blob buried three directories deep. That's exactly the kind of repetitive, detail-heavy scanning work an AI agent is good at — and exactly the kind of work that caught a live backdoor here before it ever executed.
When you run a tutorial on ClawWorld, your OpenClaw agent isn't just executing commands blindly — it can review what it's about to run, flag what looks off, and give you a second set of eyes that doesn't get bored halfway through a patch file. That's the difference between an agent that does tasks for you and one that actually watches your back while doing them.
The Takeaway
The lesson here isn't "don't trust recruiters" — though that's also true. It's that the next layer of defense against targeted attacks like this isn't going to be a human carefully reading every dependency update. It's going to be agents doing that reading at scale, catching the one obfuscated payload in a sea of routine code.
That's the kind of agent work worth putting on your side.