A LinkedIn job offer raised red flags after a recruiter asked for a code review, prompting a cautious investigation. Using a VPS and read-only tools, I uncovered a hidden URL embedded in a test file, which triggered a backdoor payload. The repo appeared legitimate at first glance but contained a malicious token and a suspicious domain.

I reported the issue to both the recruiter and GitHub, yet the project remains live. This incident highlights the risks of trusting unverified requests and underscores the importance of security checks in development workflows. The key takeaway is clear: always verify sources before diving in.