tl;dr: A developer received a suspicious "take-home interview" from a fake recruiter offering an inflated salary, and found the provided FastAPI project contained malicious Git hooks that fetched OS-specific payloads from a remote IP. The multi-stage attack ultimately installed Node.js and ran an obfuscated parser.js with dependencies like clipboardy and Hardhat, suggesting crypto wallet theft, with unique IDs per victim for tracking. Variants of the scam also use .vscode launch configs to trigger execution just by opening the folder, targeting developers via LinkedIn with cloned legitimate repos as cover.