Fake job offer ZIP runs malware through a plain git status

How does the Git trap work?

Git can run outside programs, and the attacker set up two ways to trigger them. The first is core.hooksPath in .git/config, which points Git to a different folder for hooks (scripts that run on events). That folder held a post-checkout script, which runs after switching branches. That explains why the README asked the reader to hop between branches.

The second is a custom "clean" filter named ltr, which Git uses to transform file content on its way into storage. A wildcard attributes rule applied it to all files. To decide whether files changed, git status can push them through that filter. So an ordinary git status, which an editor may run on its own, can launch the script .git/ltr.

The author confirmed this on a harmless test repository, where git status called the filter and a branch switch also called post-checkout.

What does the script do?

It is a shell script with a debounce: it logs the time of each filter call, and a background process waits until two seconds pass without a new one, so it only fires once. A directory created with mkdir acts as a lock. Then it detects the operating system, downloads code from a vercelscript.vercel.app subdomain and runs it, through sh on Linux and macOS or PowerShell on Windows. Output and errors go to /dev/null, so the user may notice nothing.

What the downloaded code does cannot be determined from the ZIP alone. It could be a next-stage loader, data theft or something else.

The practical lesson: a repository sent as an archive with its .git folder is not the same as a clone from GitHub or GitLab, and opening it in an IDE can be risky.