A developer-targeted LinkedIn recruiting lure sent the author to a public GitHub repository containing a hidden Node.js backdoor. The malicious code in `app/test/index.js` assembled `https://rest-icon-handler.store/icons/77` and was designed to execute whatever the remote server returned, while `package.json` used an npm `prepare` lifecycle script so `npm install` would trigger it automatically. The operation also used borrowed identities: commits were attributed to a real developer who denied involvement, and the recruiter profile appeared to impersonate a real non-technical journalist.