Worklo: Fake Startup, Real Malware in the Take-Home Assignment

A fake startup called Worklo used LinkedIn recruiters, a polished website, and a rigged take-home assignment to deliver npm supply chain malware via a private scoped package with an embedded auth token.