supabase

The code does not show indicators of intentional malware or supply-chain compromise. It implements a Stripe/Supabase invoice-sending endpoint, but contains significant application security weaknesses: an unvalidated and apparently unauthorized invoiceId controls a privileged invoice-send operation, and the request body is read twice, preventing reliable webhook verification. The endpoint should preserve the raw body for signature verification, validate the event type and invoice relationship, and enforce caller authorization before using the service-role client.

No evidence of malicious or supply-chain attack behavior is present. The code is a conventional Supabase/Next.js server endpoint, but it likely contains an authentication-check bug: it checks the getSession() data wrapper instead of data.session. If Row Level Security or other authorization controls do not independently restrict the projects query, unauthenticated callers may obtain project data. The endpoint also returns all selected columns and rows, so its scope should be reviewed.