Scorpse

Attack Interview 01 — The recruiter and the borrowed Git history

Tue, 10 Nov 2026 13:34:49 GMT

The LinkedIn message pitched a remote technical role at “A5 Labs.” It mentioned decentralized AI, gaming, and more than $30 million in funding. A Google Doc supplied the brief, and a Calendly link made the next step feel routine. Then came the coding exercise. Clone the repository, get it running, and take a look.

That last step was the one I wanted to understand. I kept two repository snapshots, Jackpot and Amonix, and read the committed files as text. They looked like ordinary versions of a poker app. The interesting part was how they got that appearance. My original LinkedIn account

Reconstruction from the saved recruiter conversation and my LinkedIn account. The funding figure was part of the pitch.

Haseeb Javed independently described a similar pitch using the A5 Labs name. People identifying themselves as A5 Labs staff replied on his post that the company was being impersonated and did not use external recruiting partners. That corroborates the use of the name as a lure. Javed’s account and the A5 Labs replies

Two repositories with almost the same source

I compared the committed trees, since both local working copies had changes from the investigation. A Git blob identifies the bytes of a file, so a matching blob lets me say the content was identical even if the file lived somewhere else.

Measurement	Jackpot	Amonix
Retained head	`3c9749cd6988`	`82ab33b18b76`
Commits reachable from head	371	323
Tracked paths at head	312	312
Exact JS/TS blob matches to Vintage Poker, regardless of path	56	59

Across the two heads, 294 of 307 shared paths had identical blobs. That included 117 of 126 shared JavaScript and TypeScript paths. In the upstream comparison, server/pokergame/Deck.js matched the samples’ game/Deck.js byte for byte. Other examples included Player.js and SidePot.js. I pinned the upstream comparison to Vintage Poker commit 408fa89c24f9. Patrick Obermeier’s Vintage Poker at the compared revision

The history belonged to a different kind of project

The two samples share 320 exact commit IDs with each other. Their shared root commit, 2cb75b0208f8, carries a July 2015 author date and contains a package named tcpie. It has the same tree object as the initial commit in silverwind’s public TCP utility.

Against the public tcpie history, each sample contained 275 matching commit snapshots, covering 271 distinct tree IDs. The two sets of commit IDs did not intersect with upstream. Matching trees establish that the file snapshots were identical. The differing commit IDs show that the surrounding Git history was recorded differently. This is a stronger comparison than counting commits or trusting author names.

Sample snapshot	Matching public `tcpie` snapshot	What matched
`2cb75b0208f8`	`c79d2821ecce`	Initial tree `46a946595765`
`de999a228dda`	`f583cc716bea`	Tree `533dabf892df`, labeled `11.0.1`

I used git rev-list for reachability, git ls-tree -r for path and blob comparisons, and git log --format=%T for tree comparisons. The upstream projects are the sources I matched. Their authors deserve credit for the legitimate work. silverwind’s tcpie at the compared revision

An old commit history made this repository feel established. To decide whether to run it, I needed to follow the files that the editor, package manager, and server would load today.

Next · 02 — What could run before the login screen · 03 — Indicators and what to look for

Attack Interview 02 — What could run before the login screen

Tue, 10 Nov 2026 13:34:49 GMT

The code I wanted to see was the code that could run before I clicked anything in the app. In these samples, there were two places to start looking. One was VS Code’s task configuration. The other was the Node server’s import path.

The folder-open tasks

Jackpot 3c9749cd6988 had two tasks with runOn: "folderOpen". The one named version-update invoked npm install. The one named env downloaded a response and passed it to a command interpreter. At lines 50, 52, and 54 of .vscode/tasks.json, the macOS, Linux, and Windows commands were preceded by 566, 564, and 562 spaces, respectively. The receiving programs were bash, sh, and cmd.

An older task in bb879a366cbe sent the downloaded response to Node instead. At the retained Amonix head, the tasks named install-root-modules and run-backend launched the npm install and backend, and the backend task depended on the install task. Both were configured for folder open. The editor path depends on Workspace Trust and permission to run automatic tasks. VS Code automatic tasks · VS Code Workspace Trust

Why npm and the auth module are one chain

The root package.json in both retained heads has the same blob, c9206c496fbf. Its prepare hook attempts to launch node server in the background using Windows and Unix shell idioms. A local npm install can run that lifecycle hook when scripts are enabled.

In both repos, server.js calls configureRoutes(app) before calling app.listen. This line from the retained route configuration loads the auth module at startup.

routes/index.js:2js

app.use('/api/auth', require('./api/auth'));

The import executes the module’s top-level code. The application can reach the outbound request during startup, before a login or even a listening HTTP server. npm lifecycle scripts

Jackpot sends a GET every five seconds

At routes/api/auth.js:18, the line starts with module.exports = router;. After 784 spaces, it continues with an obfuscated program. The full line is 3,334 characters in the retained blob. An export assignment leaves the rest of the line executable.

The code rotates a string table and looks up names by numeric index. Reading those literals reveals a host fingerprint built from hostname, OS type, release and platform, plus a MAC address selected from a non-internal IPv4 interface if one is available. The request serializes that fingerprint into sysInfo and the Node process environment into processInfo. Both are query fields on a GET to plain HTTP port 1224, path /api/checkStatus. The other fields are tid and sysId.

The code attempts an initial request at import time, then calls it again every 0x1388 milliseconds, or 5 seconds. It parses the reply as JSON. When status equals error, it passes message to eval. A truthy returned sysId becomes the value sent in later requests.

The tid value is sent in its encoded form. The figure shows its decoded text for analysis.

Amonix sends a POST and runs the response

At 82ab33b18b76, the server loads dotenv before configuring routes. The committed .env contains a Base64 AUTH_API value, which setApiKey decodes as a URL. At controllers/auth.js:57–63, verify sends a copy of process.env as the POST body with the header x-app-request: ip-check. At routes/api/auth.js:25–28, the response becomes the body of a new function and is called with Node’s require.

There is an odd detail at the top of that module. validateApiKey() is async, but the caller checks the returned Promise as a boolean without awaiting it. The Promise is truthy and the apparent gate does not wait for verification. The request has already been initiated.

Both heads also replace the password check with const isMatch = true; at controllers/auth.js:29. If the app were running with a database and an existing account, that could let a validly shaped login request bypass the password comparison. It is a separate flaw from the code that runs at startup.

These are static execution paths. The observed evidence is the code, its inputs, and the operations it attempts. The effects of a successful remote response would depend on its contents and the permissions of the developer process.

In this series · 01 — The recruiter and the borrowed Git history · 03 — Indicators and what to look for

Attack Interview 03 — Indicators and what to look for

Tue, 10 Nov 2026 13:34:49 GMT

What would I look for on a machine where someone opened this take-home and let the editor run its tasks? I would start with the process tree and the time of the interview, then check whether those processes made the requests the source describes. The saved Git history gives us several concrete leads.

Network references in the retained history

I scanned the committed task and auth files and decoded only URL-shaped values for AUTH_API and AUTH_API_KEY in tracked environment files. The expanded pass found 26 unique host references across both clones. I separate them by where the reference appeared and whether the corresponding loader was present in the same snapshot. These are historical indicators from source. Host availability and successful execution were outside this review.

Evidence class	Hosts	Where the values appear
Editor download commands	8	`.vscode/tasks.json`, with a folder-open task and a downloader
Jackpot beacon	4	Base64 URL in a route with `process.env`, `eval`, and a repeating timer
Environment POST configuration	10	`AUTH_API` alongside the route constructor and controller POST
Other historical configuration	4	`AUTH_API_KEY` references whose connection to the same loader was unverified

Jackpot beacon. All four addresses below appear in the route as plain HTTP on port 1224 with path /api/checkStatus.

Address	Example Jackpot commit containing it
`147[.]124[.]212[.]180`	`4baa179d64bd`
`147[.]124[.]212[.]207`	`f6c017386671`
`216[.]250[.]251[.]187`	`de75f7a9f040`
`216[.]250[.]252[.]245`	`3c9749cd6988`, the retained head

Editor downloads. The shared suffix is [.]vercel[.]app. The subdomains 0g-auth-check, oracle-v3-nu, and oracle-reg-check appear with /api/validate. The five subdomains ip-address-check-moa5, vscode-check-mo1, vscode-check-mo2, vscode-settings-0511, and vscode-settings-529 appear with /api/settings/mac, /api/settings/linux, or /api/settings/windows. At the retained Jackpot head the task uses vscode-check-mo2.

Environment POST. Under the same Vercel suffix, I found these /api destinations alongside the corresponding loader: api-royaljapan, api111-jade, ip-check-pc, ip-checking-notification-pic, ip-core-api-0511, ip-testcheck, ipcheck-royal, ipcheck-six, project-mjecx, and test-ip-check. Amonix’s retained head points to ip-testcheck[.]vercel[.]app/api. The four configuration-only /api/data subdomains were ake-test, astrahub, rgg-vercel, and test-g-acs.

For matching a saved copy, these are SHA-256 hashes of the exact committed route files, including their original whitespace.

Source file	SHA-256
Jackpot `3c9749cd6988:routes/api/auth.js`	`0fe2f88e19dbbb1523bb5b3d9adbf46bfa56eec5fb583ecbf04942dc5d86703a`
Amonix `82ab33b18b76:routes/api/auth.js`	`28e73ce85db813ba0839ee077428eaa121037e3a1ec8a13b1171e68cc2a0accd`

What makes a useful hunt signal

Editor or npm process tree. Around the interview time, look for VS Code spawning a shell that launches curl or wget, or an install spawning node server from the checkout. Correlate the parent process, working directory, command line, and destination.
Repeated outbound GETs. Look for Node contacting port 1224 and /api/checkStatus at about five-second intervals, with fields named sysInfo, processInfo, tid, and sysId. Query strings may contain secrets. Preserve them in restricted evidence storage.
An outbound POST at startup. Look for Node reaching an exact matching hostname with x-app-request: ip-check, where your telemetry records headers. Correlate that with execution of the repository. Shared hosting makes the full hostname and path more useful than the provider domain alone.

Where it fits in the public research

Kudelski Security independently documented a related auth.js sample with the same unusual tid text, request shape, port, and status: error evaluation condition, using a different IP address. OpenSourceMalware reported the editor-task delivery pattern. These are concrete overlaps with activity tracked as Contagious Interview. Unit 42 documented BeaverTail and InvisibleFerret in that campaign. My local evidence establishes the loaders in these snapshots. Operator identity and any downloaded second stage remain unverified for this case. Kudelski’s technical analysis · OpenSourceMalware’s VS Code research · Unit 42 campaign research · MITRE ATT&CK G1052

If one of the execution paths may have run, isolate the device and involve your security team. Record the repo and revision, interview time, and actions you took. Revoke exposed sessions and rotate accessible credentials from a known-clean device. Include source control and cloud access in that review, since developer credentials can reach beyond the laptop. For a new take-home, verify its origin independently, inspect its workspace and lifecycle settings first, and use a disposable environment without work credentials if execution is required. Atlassian’s guidance for candidates and responders

In this series · 01 — The recruiter and the borrowed Git history · 02 — What could run before the login screen

Building Câmpenește, a calendar for Romania’s rural events

Tue, 10 Nov 2026 11:17:51 GMT

The question behind Câmpenește was simple. What’s happening in the Romanian countryside this weekend, and can I get there and back in a day?

An event name and a village can get you started. Planning a trip takes a confirmed date, a usable location, and some idea of the drive. An old festival page can look current at a glance while quietly describing last year’s edition. I wanted a guide that made that difference visible. Câmpenește

A local build, a public launch, and the work after it

I started with a local app in November 2026. Before putting it online I worked on the catalogue, the map and road routes, duplicate editions, and the way a source could support a confirmed date. Hosting was the next milestone. The public version then gave me more concrete questions to work through, from finding a festival on a phone to deciding what counted as enough evidence to publish a trip guide.

When, in Bucharest time	Milestone
8 Nov, 19:52–21:08	Local app first. The catalogue gained road routes, tags, deduplicated editions, county coverage, and source checks for upcoming events.
8 Nov, 21:15–23:21	First Azure preview, then the custom domain and monitoring. Visitor suggestions and scheduled research also entered the app that evening.
9 Nov, early morning	Permanent event pages, a faster mobile discovery flow, the first private operations dashboard, and a GitLab pipeline that verified the Azure deployment before publishing a release.
9 Nov, daytime and evening	Trip guides, itineraries, driving times between stops, archive photos, admin sessions, weekly editorial review, source triage, and further refinements to discovery and the departure selector.
10 Nov, morning	Location and analytics-consent refinements, followed by monitoring for official Facebook sources in the `v0.29.0-beta.1` release.

The preview deployment commit came 1 hour 24 minutes after the first local implementation commit. The custom-domain commit followed 3 hours 29 minutes after that first commit. The snapshot used for this article was 39 hours 34 minutes into the recorded Git history. By then, 59 of the 75 commits on main came after the domain setup. Those are elapsed intervals between Git milestones. The local build, launch, and subsequent rounds of refinement each had their own work.

The public app and its data

The public app runs on Node.js 24 LTS and Express. It serves permanent event pages as HTML and uses one catalogue for the list, calendar, and Leaflet map. Visitors can pick a departure point and compare estimated road distances and driving times. The calendar keeps past editions in their actual years and includes entries with documented dates. Browse the catalogue

The data model separates an event series, one edition of that event, and the sources that support what we know. An old edition can tell you that a fair exists. A current source is what lets it appear on this year’s calendar. The curated catalogue starts as JSON in Git. The running app stores observations and cached routes in persistent JSON. It replaces state files atomically on a single instance.

The admin became an editorial workspace

The first dashboard put catalogue coverage, worker health, and visitor suggestions in one place. It grew into an authenticated workspace with tabs for suggestions, research, leads, sources, and statistics, plus a weekly editorial view. I can compare a candidate date with the existing edition, open the source, and decide whether it belongs in the public catalogue. The research worker can surface changes or conflicting evidence, and an optional Azure Foundry review can help triage leads. The catalogue update is a separate editorial decision.

I added password-based sessions using a scrypt hash, secure session cookies in production, and same-origin and CSRF checks for administrative changes. Catalogue editing and backup export stay in the local app. The Azure worker runs a bounded batch on an hourly Logic Apps schedule, and the dashboard can show its health separately from the public site’s health.

Admin screenshot from a local copy loaded with the public seed catalogue. It shows the interface using demonstration data.

A few technical facts from the deployed snapshot

Item	At `613c86d`, released as `v0.29.0-beta.1`
Application code	19,972 physical lines across 77 tracked JS, HTML, and CSS files in the app, public UI, and admin.
Tests	9,425 physical lines in 57 tracked test and test-helper files. GitLab pipeline #2215 reported 281 tests passed.
Catalogue	130 series in the tracked seed catalogue. The public catalogue showed coverage across 41 counties when I captured it.
Hosting	One Linux Azure App Service Basic B1 instance with persistent storage, and an hourly Azure Logic Apps worker. The preview started on the Free tier.
Delivery	GitLab validates the code and packages a release. A protected production child pipeline deploys the ZIP to Azure, checks the live HTTPS version and commit, and then publishes the version tag and release.

The line counts include blank lines and comments. They exclude dependency trees, catalogue data, documentation, and assets. The public health endpoint reports the deployed version and commit. Câmpenește health endpoint

Project documentation

Câmpenește’s design notes, research notes, and release notes are Markdown in Git. Its catalogue and runtime state are JSON, and Express runs the interactive app.

The part I’d keep if I rebuilt it is the distinction between a known series and a confirmed edition. The map helps people find a place. The evidence helps them decide whether it’s worth getting in the car. Visit Câmpenește