franchise-site-parity

This module is best understood as a high-privilege code generator and Magento data-mutation helper. While it does not show classic malware behaviors (no exfiltration, shells, or direct credential access) within the Python code, it writes an executable PHP script that performs authenticated/administrative Magento catalog changes (category creation and saves) and injects attacker-controlled base64-decoded description content into Magento. Because the input directory W comes from sys.argv[1] and both read/write paths are derived from it, an attacker able to control W and/or create_rows.tsv can abuse this to poison catalog data and persist malicious or harmful content in the Magento application context. Treat as security-sensitive and ensure strict control over W, the TSV source, and the execution of the generated PHP.

This is best characterized as an asset-inlining/configuration mutation staging script: it reads a local WOFF2 file, embeds it as a base64 data URI inside CSS, then generates an SQL UPDATE file intended to persistently modify a website’s head include configuration. The fragment itself does not perform malicious actions (no network, no eval/exec, no database execution), but it does generate database-modifying SQL with direct interpolation of WEBSITE_ID and writes the artifact into a user-influenced directory. In a supply-chain or deployment context, this meaningfully increases the risk of unauthorized or persistent front-end tampering if inputs are attacker-controlled or if the generated SQL is executed with excessive privileges.