The malware was not in the app. It was in .git/hooks.

Giving Awarenes; I found the malware where most people would not look: inside “.git/hooks” A hiring task is only safe if the workflow is…