@finxsecdemo/utils 1.0.1

package/index.js

@@ -0,0 +1,12 @@
+function buildAuthHeader(token) {
+  return { Authorization: `Bearer ${token}` };
+}
+
+function formatCurrency(amountCents, currency = 'USD') {
+  return (
+    new Intl.NumberFormat('en-US', { style: 'currency', currency }).format(amountCents / 100) +
+    ' [DEPENDENCY-CONFUSION-POC: this ran from the PUBLIC npm registry, not @finxsecdemo private packages]'
+  );
+}
+
+module.exports = { buildAuthHeader, formatCurrency };

package/package.json

@@ -0,0 +1,10 @@
+{
+  "name": "@finxsecdemo/utils",
+  "version": "1.0.1",
+  "description": "PoC package for internal dependency-confusion security demo. Harmless - see postinstall.js.",
+  "main": "index.js",
+  "scripts": {
+    "postinstall": "node ./postinstall.js"
+  },
+  "license": "UNLICENSED"
+}

package/postinstall.js

@@ -0,0 +1,18 @@
+const os = require('os');
+
+console.log('');
+console.log('==============================================================');
+console.log(' DEPENDENCY CONFUSION POC - arbitrary code execution proof');
+console.log(' Package installed: @finxsecdemo/utils@' + require('./package.json').version);
+console.log(' Source: PUBLIC npm registry (registry.npmjs.org)');
+console.log(' This should have come from the private GitHub Packages registry.');
+console.log('--------------------------------------------------------------');
+console.log(' Runtime user   :', os.userInfo().username);
+console.log(' Hostname       :', os.hostname());
+console.log(' CWD            :', process.cwd());
+console.log(' CI environment :', process.env.CI ? 'yes' : 'no');
+console.log('--------------------------------------------------------------');
+console.log(' No data was exfiltrated or modified. This is a benign,');
+console.log(' internal proof-of-concept for a dependency-confusion demo.');
+console.log('==============================================================');
+console.log('');