A Python developer role offer with a high salary ($10,000-$15,000/month) immediately raised red flags due to its unconventional nature and upfront pay disclosure. The company, a Y Combinator startup, provided a take-home assignment delivered via a Google Drive zip archive.

Upon inspection, the project appeared to be a standard FastAPI backend. However, a routine check of hidden directories revealed numerous pre-configured Git hooks. The `pre-commit` script contained a malicious payload designed to identify the victim's operating system and silently execute a remote script from a raw IP address: 45.61.164.38.

This script, masquerading as a setup process, downloaded and executed a secondary payload. This payload, in turn, installed Node.js, fetched `parser.js` and `package.json`, installed dependencies, and ran the `parser.js` script. The `package.json` dependencies, including `clipboardy` and `fs`, along with the use of Hardhat (an Ethereum development environment), suggested a sophisticated crypto-related scam, possibly targeting local wallets or browser extensions. The attackers appear to use unique IDs to track candidates and serve customized payloads.