Moonstone Sleet malicious npm packages / fake skills assessments

Microsoft Threat Intelligence (Microsoft Security Blog)

Microsoft has observed Moonstone Sleet targeting potential victims with projects that used malicious npm packages. Often, the threat actor delivered these projects through freelancing websites or other platforms like LinkedIn. ... This actor has also targeted individuals looking for work in software development, sending candidates a “skills test” that instead delivers malware via a malicious NPM package.