What workarounds did people try for "Client sent me code to run locally is it malware?"?

Community members documented 7 workarounds: 1. Running client projects inside isolated, hardened containers or virtual machines 2. Using tools like npx npq to precheck dependencies 3. Developing on a secondary throwaway laptop or rare operating system 4. Refusing to run unfamiliar repositories and walking away 5. Disabling the Run hotkey via registry keys or configuration policies 6. Restricting user access to PowerShell and command prompt through Group Policy Objects 7. Deploying endpoint detection and response tools to automatically flag and quarantine malicious executions

Client sent me code to run locally is it malware?

Malicious actors on freelance platforms and LinkedIn trick developers into executing obfuscated code, repos, or installation scripts under the guise of project testing. This exposes local machines to compromise and prevents safe evaluation of client-provided repositories.

Overview

Last updated Sep 14, 2026

People affected4 accounts across 2 forums

Workarounds found7 items attempted

Community agreement1,013 total upvotes

What the numbers show

Counted from the threads quoted below. How we count

The most recent one is from September 2026.
This comes up 375.8× more often in r/freelance than across the site as a whole.

What people tried

Every workaround mentioned in the threads below. We haven’t tested any of them — and nobody here is claiming they worked.

7 items+ Contribute

Found another way around this?

Share your steps and trade-offs so fellow engineers don't have to reinvent the wheel. No account required.

1
Running client projects inside isolated, hardened containers or virtual machines
Did this help you?
2
Using tools like npx npq to precheck dependencies
Did this help you?
3
Developing on a secondary throwaway laptop or rare operating system
Did this help you?
4
Refusing to run unfamiliar repositories and walking away
Did this help you?
5
Disabling the Run hotkey via registry keys or configuration policies
Did this help you?
6
Restricting user access to PowerShell and command prompt through Group Policy Objects
Did this help you?
7
Deploying endpoint detection and response tools to automatically flag and quarantine malicious executions
Did this help you?

Tried another approach not listed above?+ Share your workaround ↑

In their words

Unedited, grouped by where they were said, most upvoted first within each place, each linked to the thread it came from.

r/freelance3 people · January 2026

“I’m new to Upwork. First “client” I get sends me a Next.js project and says “just run it locally and see if it works.” They sent malware.”source ↗

Jaded-Journalist2470 · r/freelance · 1,003 upvotes

“It also happened to me. It was a crypto project and I had a call with a guy and he said he is the CTO of the company and he wanted to help me with setting up the project. He asked me to share mu screen and install the project and I found it strange.”source ↗

zapdigits_com · r/freelance · 6 upvotes

“I had similar after someone contacted me on linkedin - they sent me a git-repo to clone and run. I just noped right out of there.”source ↗

FarAwaySailor · r/freelance · 3 upvotes

r/sysadmin1 person · September 2026

“We had this happen at our org a few months ago.”source ↗

explosivecaterpillar · r/sysadmin · 1 upvotes

Where this came up

r/freelance r/sysadmin cybersecurity development endpoint management freelancing malware security sysadmin