Attack Interview 01 — The recruiter and the borrowed Git history
The LinkedIn message pitched a remote technical role at “A5 Labs.” It mentioned decentralized AI, gaming, and more than $30 million in funding. A Google Doc supplied the brief, and a Calendly link made the next step feel routine. Then came the coding exercise. Clone the repository, get it running, and take a look.
That last step was the one I wanted to understand. I kept two repository snapshots, Jackpot and Amonix, and read the committed files as text. They looked like ordinary versions of a poker app. The interesting part was how they got that appearance. My original LinkedIn account
Reconstruction from the saved recruiter conversation and my LinkedIn account. The funding figure was part of the pitch.
Haseeb Javed independently described a similar pitch using the A5 Labs name. People identifying themselves as A5 Labs staff replied on his post that the company was being impersonated and did not use external recruiting partners. That corroborates the use of the name as a lure. Javed’s account and the A5 Labs replies
Two repositories with almost the same source
I compared the committed trees, since both local working copies had changes from the investigation. A Git blob identifies the bytes of a file, so a matching blob lets me say the content was identical even if the file lived somewhere else.
| Measurement | Jackpot | Amonix |
|---|---|---|
| Retained head | 3c9749cd6988 |
82ab33b18b76 |
| Commits reachable from head | 371 | 323 |
| Tracked paths at head | 312 | 312 |
| Exact JS/TS blob matches to Vintage Poker, regardless of path | 56 | 59 |
Across the two heads, 294 of 307 shared paths had identical blobs. That included 117 of 126 shared JavaScript and TypeScript paths. In the upstream comparison, server/pokergame/Deck.js matched the samples’ game/Deck.js byte for byte. Other examples included Player.js and SidePot.js. I pinned the upstream comparison to Vintage Poker commit 408fa89c24f9. Patrick Obermeier’s Vintage Poker at the compared revision
The history belonged to a different kind of project
The two samples share 320 exact commit IDs with each other. Their shared root commit, 2cb75b0208f8, carries a July 2015 author date and contains a package named tcpie. It has the same tree object as the initial commit in silverwind’s public TCP utility.
Against the public tcpie history, each sample contained 275 matching commit snapshots, covering 271 distinct tree IDs. The two sets of commit IDs did not intersect with upstream. Matching trees establish that the file snapshots were identical. The differing commit IDs show that the surrounding Git history was recorded differently. This is a stronger comparison than counting commits or trusting author names.
| Sample snapshot | Matching public tcpie snapshot |
What matched |
|---|---|---|
2cb75b0208f8 |
c79d2821ecce |
Initial tree 46a946595765 |
de999a228dda |
f583cc716bea |
Tree 533dabf892df, labeled 11.0.1 |
I used git rev-list for reachability, git ls-tree -r for path and blob comparisons, and git log --format=%T for tree comparisons. The upstream projects are the sources I matched. Their authors deserve credit for the legitimate work. silverwind’s tcpie at the compared revision
An old commit history made this repository feel established. To decide whether to run it, I needed to follow the files that the editor, package manager, and server would load today.
Next · 02 — What could run before the login screen · 03 — Indicators and what to look for