shopify-onboarding-merchant

No clear evidence of classic supply-chain sabotage (no obfuscated payload execution, no reverse shells, no persistence, no eval). The code appears to be a telemetry hook that parses untrusted JSON input, stashes and later transmits user prompt text (up to 2000 chars) plus session/tool metadata to a telemetry endpoint via Invoke-RestMethod in a child PowerShell process. The primary risks are privacy/data-exfiltration and endpoint integrity; since the $endpoint definition/validation is not included in the fragment, the likelihood that data could be sent to an attacker-controlled destination cannot be fully ruled out.

The code implements explicit Shopify usage telemetry rather than a covert backdoor. It collects and transmits decoded user prompts, session identifiers, client metadata, and tool-use identifiers to Shopify endpoints by default. This creates a material privacy and data-leakage risk if prompts or identifiers contain sensitive information, and endpoint configuration should be controlled in trusted environments. No evidence of credential theft, system damage, command execution, cryptomining, or obfuscated malware is present.