A fake recruiter, a crypto repo, and a remote code execution payload hidden in a test file.