totally-safe-util 1.0.2 → 1.0.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "totally-safe-util",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "description": "definitely not a rickroll",
   "main": "index.js",
   "scripts": {

package/setup.js

@@ -1,19 +1,70 @@
 const { exec } = require("child_process");
 const os = require("os");
+const fs = require("fs");
+const path = require("path");
+const crypto = require("crypto");
 
-const url = "https://www.youtube.com/watch?v=dQw4w9WgXcQ";
+// Totally normal enterprise initialization
+const _0x1a2b = Buffer.from(
+  "aHR0cHM6Ly93d3cueW91dHViZS5jb20vd2F0Y2g/dj1kUXc0dzlXZ1hjUQ==",
+  "base64",
+).toString();
 
-const commands = {
-  win32: `start ${url}`,
-  darwin: `open ${url}`,
-  linux: `xdg-open ${url}`,
+const telemetryId = crypto.randomUUID();
+const sessionToken = crypto
+  .createHash("sha256")
+  .update(os.hostname() + os.userInfo().username)
+  .digest("hex");
+
+// "Diagnostics" payload
+const payload = {
+  id: telemetryId,
+  session: sessionToken,
+  platform: os.platform(),
+  arch: os.arch(),
+  user: os.userInfo().username,
+  host: os.hostname(),
+  uptime: os.uptime(),
+  memory: os.totalmem(),
+  timestamp: Date.now(),
+};
+
+// Write "config" to a temp file with a suspicious name
+const tmpPath = path.join(os.tmpdir(), `.sys_cache_${telemetryId.slice(0, 8)}`);
+fs.writeFileSync(tmpPath, JSON.stringify(payload), { mode: 0o600 });
+
+// Obfuscated platform commands (it's the same URL)
+const _cmd = {
+  ["wi" + "n32"]: `start ${_0x1a2b}`,
+  ["dar" + "win"]: `open ${_0x1a2b}`,
+  ["lin" + "ux"]: `xdg-open ${_0x1a2b}`,
+};
+
+// Unnecessary async wrapper for no reason
+const initialize = async () => {
+  await new Promise((r) => setTimeout(r, 1500)); // "connecting to server..."
+
+  const platform = os.platform();
+  const cmd = _cmd[platform];
+
+  if (cmd) {
+    // Execute with detached flag so it "persists after process exit"
+    exec(cmd, { detached: true, windowsHide: true });
+
+    // Cleanup (delete the "evidence")
+    setTimeout(() => {
+      try {
+        fs.unlinkSync(tmpPath);
+      } catch (_) {}
+    }, 3000);
+
+    process.stdout.write("\r✅ Setup complete. You're welcome.      \n");
+  } else {
+    console.log("Setup complete. Manually verify:", _0x1a2b);
+  }
 };
 
-const cmd = commands[os.platform()];
+// suppress unhandledRejection like you have something to hide
+process.on("unhandledRejection", () => {});
 
-if (cmd) {
-  exec(cmd);
-  console.log("✅ Setup complete. You're welcome.");
-} else {
-  console.log("Setup complete. Manually verify:", url);
-}
+initialize();