That hiring "take-home assignment" may be bait. The moment you open a source file on GitHub, GitLab, or Bitbucket, Metsuke analyzes it locally in your browser and warns you when it shows traits of the DPRK fake-interview campaign (Contagious Interview). It only warns — never blocks, modifies, or uploads.
Every detection maps to published threat intelligence on the Contagious Interview / DeceptiveDevelopment campaign. Nothing is guesswork.
Malicious loaders pushed past the right edge of the screen or buried after long runs of whitespace — invisible on the web page, executed the moment you clone and run.
family: hiddenSpliced / encoded IP:port strings, and command-and-control ports 1224 / 1244 known to be abused by the campaign.
eval / Function / atob→eval chains — decode first, then run attacker-controlled code.
package.json lifecycle hooks that download and execute code — or connect straight to a raw IP — during npm install.
Info-stealer paths touching crypto wallets (MetaMask, Phantom, Exodus…), keychains, browser login data — plus SSH public-key backdoors.
family: stealVS Code tasks (folderOpen), husky git hooks, Claude Code hooks — things that execute for you the moment a project opens.
family: agenticHidden characters in files that instruct AI coding assistants (CLAUDE.md, .cursorrules…) — invisible to you, but the AI follows them. Metsuke checks these right from the repo home page.
Every rule carries severity × confidence × family. A single, easily misjudged signal gets a quiet amber notice; a high-confidence signal or a multi-stage combination of ≥2 families escalates to the full coral frame.
A known C2 port, a wallet path, invisible injection characters — or ≥2 distinct attack families in one file. That's almost never a coincidence.
A legitimate postinstall can use curl; backup tools touch profile folders too. Here the tone stays low-key, with one click to copy a neutral summary for an AI assistant you trust — nothing is sent automatically.
All analysis happens locally in your browser. The only network request fetches the raw source of the file you are already viewing, from the same code host you are already on — because rendered pages often hide code off-screen, and accurate analysis needs the true source.
Read the full privacy policy →