Web3 developer opens hiring assignment folder in Cursor and gets infected with malware

Web3 developer brucexu.eth reported that opening a project folder received during a fake hiring process in Cursor infected his machine in January, though no assets were lost. He said he never ran the code directly, but SlowMist founder Cos, who analyzed the sample, noted that merely opening a project folder can trigger malicious code through configured tasks. The incident highlights the distinction between a developer executing code and a development tool performing preset actions when loading a project. It matters because crypto developers routinely review unfamiliar repositories from prospective employers, making tooling-level execution a broad attack surface. What to watch next is whether wallets and dev tools add clearer warnings or sandboxing for folder-open events.