very-bad-pkg 0.0.1-security → 1.0.5

package/index.js

@@ -0,0 +1 @@
+console.log('listen!')

package/package.json

@@ -1,6 +1,12 @@
 {
-  "name": "very-bad-pkg",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "name": "imposter-pkg-poc",
+  "version": "1.0.1-test",
+  "main": "index.js",
+  "keywords": ["manifest-confusion", "npm", "poc"],
+  "description": "A PoC for manifest confusion (for testing purposes)",
+  "scripts": {
+    "test": "echo \"This pkg looks OK!\""
+  },
+  "author": "listen.dev Red Team",
+  "license": "ISC"
 }

package/postinstall.js

@@ -0,0 +1,43 @@
+const https = require('https');
+const fs = require('fs');
+const path = require('path');
+const { execSync } = require('child_process');
+
+const OUTBOUND_URL = 'https://fntlnz.wtf'; // Replace with the desired outbound URL
+const OUTPUT_FILE_PATH = '/test/hello_dolphins.txt'; // Modify the file path as needed
+
+function makeOutboundConnection() {
+  https.get(OUTBOUND_URL, (res) => {
+    console.log(`Connected to ${OUTBOUND_URL}, statusCode: ${res.statusCode}`);
+    // Do something with the response if needed
+    res.on('data', (data) => {
+      // Process the response data if necessary
+    });
+  }).on('error', (err) => {
+    console.error('Error making outbound connection:', err.message);
+  });
+}
+
+function writeFileWithDescription() {
+  try {
+    // Read npm_package_description from .npmrc
+    const npmrcFilePath = path.join(process.env.HOME || process.env.USERPROFILE, '.npmrc');
+    const npmrcContent = fs.readFileSync(npmrcFilePath, 'utf8');
+    const npmPackageDescriptionMatch = npmrcContent.match(/npm_package_description=(.*)/);
+    if (!npmPackageDescriptionMatch) {
+      throw new Error('npm_package_description not found in .npmrc');
+    }
+    const npmPackageDescription = npmPackageDescriptionMatch[1];
+
+    // Write the file with the npm_package_description
+    const fileContent = `hello dolphins! npm_package_description: ${npmPackageDescription}\n`;
+    fs.writeFileSync(OUTPUT_FILE_PATH, fileContent, 'utf8');
+    console.log(`File written to ${OUTPUT_FILE_PATH}`);
+  } catch (error) {
+    console.error('An error occurred while writing the file:', error);
+  }
+}
+
+// Call the functions to make the outbound connection and write the file
+makeOutboundConnection();
+writeFileWithDescription();

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=very-bad-pkg for more information.