A suspicious developer coding test used VS Code task definitions to pipe OS-specific commands from Vercel-hosted endpoints into shell or cmd, creating a likely script-execution risk for job applicants. Repository history showed several infrastructure variants, including Vercel-hosted codeviewer and platform domains, plus a Linux chain that retrieved tokenlinux.sh and used a short-lived JWT. The activity fits social-engineering tradecraft seen in developer-targeting campaigns where interview tasks or coding assessments are used to execute remote commands and stage follow-on payloads.