Honeypot Analysis of a Contagious Interview npm-Install Loader: Exfiltration Behavior of ADDPOB/MVP ("Zeinyra") Across Three Instrumented Runs

Fake technical interviews remain a reliable delivery channel for malware aimed at software developers. This paper presents a static and dynamic analysis of the GitHub lure repository ADDPOB/MVP, a Vite + React "Zeinyra" DeFi take-home task that executes an obfuscated stage-1 loader from postcss.config.js during a plain npm install. Stage 1 resolves a rotating C2 address via a public JSON dead-drop, POSTs a shallow copy of process.env with header x-secret-header: secret, and evaluates the response as Node code with full require privileges. Three instrumented honeypot runs on a throwaway VPS captured stage-2 modules autoUploadScript, ldbScript, and socketScript. In every run, stage 1 reached the live attacker C2 carrying only canary secrets; secondary-C2 upload traffic was blocked (run 1) or redirected to a local fake-C2 sink that never forwarded it (runs 2-3). The file-sweep module uploaded 44 of 62 baits (run 2) and 36 of 47 baits (run 3), including unrelated project trees and small fabricated creative assets (.fig, .psd, .pdf, .jpg, .png). Selection was by name and extension, not content, and skipped folders named node_modules, .git, styles, hooks, public, and assets. No persistence and no interactive operator activity were observed. The sweep targets broad classes of source code, configuration, secrets, and design files across the home directory, including projects unrelated to the lure; motive is not attributed. Defanged IOCs, detection guidance, and ethical constraints are provided. All times are UTC+3. The accompanying artifact bundle (addpob-mvp-artifacts.zip) contains sanitized run reports, bait inventories, and machine-readable IOCs; it contains no malware.