The network for creativity
Join 1.25M professional creatives like you
Connect with clients, get discovered, and run your business 100% commission-free
Creatives on Contra have earned over $150M and we are just getting started
Back to feedPost
A scammer reached out to me on this platform yesterday.
I can't explain much, read that yourselves. I'd seen these kinds of scams on LinkedIn posts for months but never in my own inbox, and this time curiosity got the best of me, so instead of running it I examined it.
It looks like a real project. But "npm run server" decrypts a payload hidden in two typosquatted npm packages and evals code pulled from the scammer's server. On a dev machine that's your wallets, logins and keys, gone.
Never run a stranger's code as an "interview." Stay safe people (and be careful of this Anna Maco individual)
The network for creativity
Join 1.25M professional creatives like you
Connect with clients, get discovered, and run your business 100% commission-free
Creatives on Contra have earned over $150M and we are just getting started
Challenges
View all
Related posts
Title: UtilForge — Client-Side Developer Tool Matrix
Summary: A suite of 20+ developer utilities that run entirely in
the browser. No uploads, no server, no data leaving your machine.
What I did: Built the full stack — Next.js frontend, Web Workers
for heavy processing (formatting tens of thousands of lines of JSON,
PDF manipulation, hashing) so the UI never blocks. Every tool works
offline after first load.
Tags: Next.js · React · TypeScript · Web Workers
Link: utilforge.dev
The no-upload promise is the strongest part. I'd make the offline state visible in the UI, so someone working with sensitive JSON or PDFs can see that the file stays on their machine before they drop it in.
Title: High-Performance SaaS MVP Build
Explanation: Delivered a production-ready SaaS analytics MVP dashboard for a startup. My responsibilities included frontend development using Next.js 14 and Tailwind CSS, backend architecture with Supabase Auth & DB, and integrating realtime data streaming (WebSocket) for dynamic charts. Reduced the standard development sprint from 6 weeks to 3 weeks, resulting in the client securing initial user feedback 50% faster than their internal roadmap anticipated. This highlights speed and scalability for early-stage ventures.
I just open-sourced my Contra MCP Starter Toolkit ⚡
Contra now has a native Model Context Protocol server, which means MCP-compatible AI agents can work directly with your Contra account — profile, services, portfolio, proposals, projects, invoices and more.
The problem: getting a coding agent properly connected still involves OAuth, PKCE, token refresh, MCP configuration and making sure the agent respects Contra’s prepare → confirm workflow.
So I packaged the setup I was using into an open-source starter kit:
What’s inside:
• One-command OAuth setup — run npm run auth, authorize Contra in the browser, and the local callback handles PKCE and token exchange.
• Zero dependencies — native Node.js 18+ only: fetch, crypto, http and fs.
• Automatic token refresh — the client catches expired sessions, refreshes the access token and retries the MCP request.
• Safe agent workflows — instructions for Cursor, Google Antigravity, Claude Code and Windsurf built around Contra’s native prepare → confirm protocol, including a full before/after review before any live mutation.
• Zero-code AI mode — copy-paste prompts for inspecting your Contra account, restructuring services, updating your profile and publishing portfolio case studies without writing JavaScript yourself.
• Content-as-Code templates — Markdown blueprints for profile positioning, flagship services, pricing, FAQs and structured case studies.
The interesting part for me isn’t just Contra.
It’s the workflow: your professional profile becomes something an AI coding agent can inspect, reason about and maintain through structured tools — while you keep final approval over every write.
If you use Contra + Cursor / Claude Code / Antigravity / Windsurf, try it and tell me what’s missing.
