Scam / Malware Warning for Freelancers

Just a heads-up for everyone offering website development, bug fixing, or coding services.

A person contacted me and claimed they needed a website bug fixed. Instead of providing proper details, they sent a ZIP project and kept asking whether I had run the files locally.

After inspecting the project, I found multiple red flags:

• Suspicious post-install script execution
• Heavily obfuscated JavaScript code
• Background process launching automatically
• Unusual behavior for a normal website project

I did NOT run the project, but based on the code structure, I would strongly advise against executing it on your main computer.

If someone sends you a project and keeps asking:
"Did you run it?"
"Did you install dependencies?"
"Did you start the project?"

Please be careful and inspect the code first.

Always:
Check package.json before running npm install
Review install/postinstall scripts
Test unknown projects in a VM or sandbox
Never run untrusted code on your personal machine

Sharing this to help protect other freelancers and developers from potentially malicious projects.

Stay safe.

Source: Contacted through my website design service thread and later sent the project via Telegram. I am sharing this as a precaution for the community.

Click to expand...

Thank you for this thread. I don't think there can be enough warnings out there to be careful, even from prospective clients.

Dirty game smh .. been through the same