Wu Xie learned that, according to monitoring by the SlowMist team, a malicious fake recruitment attack campaign targeting Web3 developers has recently appeared. The attackers posed as recruiters on LinkedIn, built trust through an interview process, and then lured developers into running a GitHub repository disguised as an “interview MVP” project. Inside the repository, a malicious Tailwind plugin was hidden in theme/js/auron-core.min.js, deploying multiple malicious payloads to steal browser credentials, wallet data, collect sensitive files, execute remote commands, and monitor the clipboard. SlowMist reminds developers that before running any unknown repository, they must check the project scripts, dependencies, and build configuration, and be alert to the risk that seemingly trusted workflows can become a carrier for attacks.