SAN FRANCISCO — A developer received a LinkedIn message Jan. 21, 2026, offering a freelance opportunity to evaluate a codebase. The message initiated a supply chain attack, redirecting the recipient to a GitLab repository containing a trojanized Node.js application designed to abuse npm lifecycle hooks and deploy a multi-stage payload for credential theft and command-and-control.
The outreach came from a LinkedIn profile identified as "Rajinder Mudhar," who claimed to be a branch manager at Fine Property (UK) Ltd. a London firm regulated by the Financial Conduct Authority. The profile displayed more than 500 connections and a verified badge, lending surface credibility.
One red flag, visible in retrospect: the profile had no posts. A professional with hundreds of connections who has never posted suggests an account built for deception rather than networking.
The pitch was attractive — evaluate a real estate tech platform for a budget of $600,000 to $800,000. The GitLab repository looked the part: a clean folder structure, React components with Three.js 3D visualizations, an Express backend using MongoDB and SendGrid integration for email. That presentation was cover for the malicious components embedded inside.
The malware hid behind standard development conventions, making it difficult to detect in a casual review. Its multi-stage architecture allowed an initial compromise to deepen into persistent system access.
A follow-up call with a contact named "Jack Murray," scheduled for Jan. 22 at noon, never happened. No email followed, no message, no reschedule request. A repository share followed by silence is a recognized indicator of a social-engineering attack.
The GitLab repository had been created Nov. 11, 2025, and contained only two commits — an anomaly for any supposedly production-ready application. A compressed commit history can obscure when and how malicious code was introduced.
Initial code review, including analysis by AI tools, returned positive assessments. Generic reviews, whether by humans or AI, lack the depth to catch sophisticated malware designed to pass surface inspection.
A dedicated security-focused analysis exposed the threat. It decoded Base64-encoded environment variables, identified use of the Function.constructor pattern for dynamic code execution and retrieved an obfuscated remote payload. The analysis also deconstructed the malware's exfiltration routines, confirming its purpose: steal credentials and enable arbitrary code execution.
For companies engaging freelance developers or integrating third-party code, the financial exposure from a successful breach — data loss, reputational damage, remediation costs — can far exceed the cost of rigorous vetting.
Attackers are building convincing digital personas and exploiting standard industry workflows to deliver payloads. This is not simple phishing; it is a technically complex infiltration method that weaponizes trust in professional networks.
Organizations must go beyond surface checks. That means mandatory deep static and dynamic code analysis for all external contributions, thorough background checks for contractors and strict network segmentation to contain any breach. Basic AI review tools are not sufficient against determined adversaries.
Every new code dependency and third-party integration is a potential attack vector. A zero-trust posture toward all external code is now a baseline security requirement, not an advanced practice.
