PSA: Scammers are targeting cryptocurrency developers through fake non-public projects on github

Through linked in, or other business websites, someone impersonating some company (like an exchange) will ask you if you can code for bitcoin/cryptocurrency/web3/whatever. Then, they'll invite you to a github repository that looks innocent and OK. It can be nodejs, C#, Rust, or anything that has its own package manager and build-script capabilities. Finally, if you open that project in your fancy IDE, like VSCode, the project build script (with nodejs, C# nuget, or cargo's build.rs in rust) will execute the malware through a child process, which can do all the typical stuff malware does, including info and browser-cookies stealing, taking crypto stored on the machine, key loggers, and so on.

So, there it's. I found this kind of attack esoteric, so I wanted to let you know that by just opening a project in your IDE, you're risking being hacked.