🛡️ Sentinel: [CRITICAL] Fix hardcoded API keys in src/secret.js

.jules/sentinel.md

@@ -0,0 +1,4 @@
+## 2025-05-14 - Hardcoded Obfuscated API Keys
+**Vulnerability:** Hardcoded API keys for multiple OSINT services (VirusTotal, UserStack, etc.) were found in `src/secret.js`, obfuscated using hex-encoded string arrays and a sampling function.
+**Learning:** Obfuscation (like hex encoding) is not a substitute for security. These keys were easily recoverable via simple Node.js execution. The file was also explicitly ignored in `.eslintrc.json` and `package.json`, which is a red flag for hidden vulnerabilities.
+**Prevention:** Always use environment variables or a dedicated secret management system for API keys. Never commit secrets to the repository, even if obfuscated. Ensure that all source files are included in linting and security scanning processes.

package.json

@@ -9,8 +9,8 @@
     "help": "node bin/infoooze.js -h",
     "check": "prettier --check .",
     "format": "prettier --write .",
-    "fix": "eslint . --ext .js  --ignore-pattern temp/ --ignore-pattern src/secret.js  --fix",
-    "lint": "eslint --ignore-pattern temp/ --ignore-pattern src/secret.js",
+    "fix": "eslint . --ext .js  --ignore-pattern temp/  --fix",
+    "lint": "eslint --ignore-pattern temp/",
     "postinstall": "node ./src/postinstall.js"
   },
   "license": "MIT",

src/secret.js

@@ -1 +1,28 @@
-var _0xf510=["\x6C\x6F\x64\x61\x73\x68","\x42\x65\x61\x72\x65\x72\x30\x63\x36\x61\x64\x31\x66\x64\x2D\x66\x37\x35\x33\x2D\x34\x36\x32\x38\x2D\x38\x63\x30\x61\x2D\x37\x39\x36\x38\x65\x37\x32\x32\x63\x36\x63\x37","\x62\x65\x61\x72\x65\x72\x20\x62\x61\x31\x64\x33\x35\x30\x65\x2D\x33\x38\x64\x33\x2D\x34\x34\x63\x31\x2D\x61\x34\x63\x63\x2D\x30\x34\x39\x32\x63\x36\x61\x33\x32\x34\x63\x31","\x62\x65\x61\x72\x65\x72\x20\x30\x30\x63\x37\x32\x30\x34\x38\x2D\x30\x30\x63\x34\x2D\x34\x39\x64\x64\x2D\x62\x65\x30\x65\x2D\x33\x64\x30\x66\x38\x39\x62\x63\x61\x39\x38\x32","\x62\x65\x61\x72\x65\x72\x20\x62\x36\x63\x39\x34\x38\x36\x63\x2D\x37\x64\x32\x33\x2D\x34\x64\x37\x38\x2D\x61\x37\x65\x39\x2D\x31\x65\x36\x39\x63\x63\x32\x62\x32\x37\x36\x64","\x61\x36\x66\x37\x66\x66\x35\x30\x38\x32\x36\x38\x62\x35\x65\x31\x38\x34\x62\x36\x65\x61\x32\x62\x38\x64\x61\x65\x61\x61\x62\x38","\x77\x6E\x34\x30\x74\x6E\x33\x62\x67\x6A\x69\x64\x6B\x74\x79\x69\x66\x7A\x7A\x73\x6F\x6D\x63\x31\x67\x30\x6C\x78\x39\x68\x65\x6D\x66\x38\x61\x30\x6C\x77\x71\x39\x79\x67\x32\x66\x30\x74\x62\x69\x75\x62\x75\x38\x6F\x33\x76\x36\x65\x30\x76\x35\x78\x63\x71\x78\x6A\x38\x35\x6B\x79\x32","\x37\x36\x66\x61\x39\x61\x33\x36\x63\x31\x37\x37\x37\x35\x39\x30\x63\x65\x36\x30\x66\x32\x37\x36\x63\x66\x30\x61\x37\x36\x30\x36\x64\x65\x39\x35\x38\x30\x38\x39\x33\x38\x39\x37\x32\x63\x31\x33\x39\x34\x38\x33\x37\x38\x35\x33\x33\x39\x62\x65\x32\x31\x35\x65","\x75\x61","\x73\x61\x6D\x70\x6C\x65","\x65\x6D","\x63\x6D\x73","\x76\x74","\x65\x78\x70\x6F\x72\x74\x73"];const _=require(_0xf510[0]);const itarm=[_0xf510[1],_0xf510[2],_0xf510[3],_0xf510[4]];const us=[_0xf510[5]];const wcms=[_0xf510[6]];const virustotal=[_0xf510[7]];var key=(_0xbca3x7)=>{if(_0xbca3x7== _0xf510[8]){return _[_0xf510[9]](us)}else {if(_0xbca3x7== _0xf510[10]){return _[_0xf510[9]](itarm)}else {if(_0xbca3x7== _0xf510[11]){return _[_0xf510[9]](wcms)}else {if(_0xbca3x7== _0xf510[12]){return _[_0xf510[9]](virustotal)}}}}};module[_0xf510[13]]= key
+const _ = require('lodash');
+
+/**
+ * Retrieves API keys from environment variables.
+ * Supported environment variables:
+ * - INFOOOZE_UA_KEY: Comma-separated list of UserAgent API keys
+ * - INFOOOZE_EM_KEY: Comma-separated list of Email validation API keys
+ * - INFOOOZE_CMS_KEY: Comma-separated list of CMS detection API keys
+ * - INFOOOZE_VT_KEY: Comma-separated list of VirusTotal API keys
+ */
+const secrets = {
+  ua: process.env.INFOOOZE_UA_KEY ? process.env.INFOOOZE_UA_KEY.split(',') : [],
+  em: process.env.INFOOOZE_EM_KEY ? process.env.INFOOOZE_EM_KEY.split(',') : [],
+  cms: process.env.INFOOOZE_CMS_KEY ? process.env.INFOOOZE_CMS_KEY.split(',') : [],
+  vt: process.env.INFOOOZE_VT_KEY ? process.env.INFOOOZE_VT_KEY.split(',') : [],
+};
+
+const key = (type) => {
+  const pool = secrets[type];
+  if (pool && pool.length > 0) {
+    return _.sample(pool);
+  }
+  // Return empty string or handle missing key in callers
+  // Most callers use it in headers, so empty string might just result in 401/403
+  return '';
+};
+
+module.exports = key;