cktool-api-base 1.0.2 → 1.0.3

package/README.md

@@ -1,42 +1,15 @@
-# ⚠️ SECURITY RESEARCH — DO NOT USE IN PRODUCTION
+# cktool-api-base
 
-**This package is a dependency confusion proof-of-concept for the Apple Security Bounty program.**
+Security research — this unscoped name was available on the public npm registry.
 
-## What is this?
+If your build resolved this package, you were likely looking for a Apple CloudKit Tool JS package. The scoped equivalent may be `@apple/cktool.api.base`, served from Apple's private registry.
 
-This package demonstrates that the unscoped name `cktool-api-base` was not defensively registered on the public npm registry. Apple's official package is `@apple/cktool.api.base` (CloudKit Tool JS — API base library).
-
-If your build system resolves `cktool-api-base` (unscoped) from the public npm registry instead of `@apple/cktool.api.base` from your private registry, this package would be installed instead of Apple's official one.
-
-## If you're seeing this
-
-Your project or build system is resolving an unscoped package name from the public npm registry. The correct package is:
-
-```bash
-npm uninstall cktool-api-base
-npm install @apple/cktool.api.base
-```
-
-You should also configure your `.npmrc` to scope internal packages to your private registry:
+Check your `.npmrc` for scoped registry configuration:
 
 ```
 @apple:registry=https://your-private-registry/
 ```
 
-## This package does NOT
-
-- Read files from your system
-- Access credentials or environment variables
-- Establish persistent access
-- Modify system state
-- Exfiltrate sensitive data
-- Send telemetry or pingback beacons
-
-## Contact
-
-- Researcher: @merrickhare
-- Program: Apple Security Bounty
-
-## License
+No files are read, no data is sent anywhere. This package exists so the name isn't claimed by someone with worse intentions.
 
-MIT
+— @merrickhare (X / Discord)

package/index.js

@@ -1,15 +1,14 @@
-// ⚠️ SECURITY RESEARCH — Apple Security Bounty
-// Dependency confusion PoC: cktool-api-base vs @apple/cktool.api.base
-// If you see this, your build pulled the wrong package.
-console.log('\n' + '='.repeat(60));
-console.log('\x1b[33m⚠️  SECURITY RESEARCH — Apple Security Bounty\x1b[0m');
-console.log('='.repeat(60));
-console.log('\nYour project required \x1b[1mcktool-api-base\x1b[0m (unscoped).');
-console.log('This is NOT Apple\'s official CloudKit Tool JS package.\n');
-console.log('The correct package is \x1b[1m@apple/cktool.api.base\x1b[0m\n');
-console.log('Fix:');
-console.log('\x1b[32m  npm uninstall cktool-api-base\x1b[0m');
-console.log('\x1b[32m  npm install @apple/cktool.api.base\x1b[0m\n');
-console.log('This PoC does NOT read files, access credentials, or');
-console.log('exfiltrate data. See https://npmjs.com/package/cktool-api-base\n');
-console.log('='.repeat(60) + '\n');
+console.log('\n' + '='.repeat(56));
+console.log('Security research —');
+console.log('\x1b[1mcktool-api-base\x1b[0m (unscoped) was available on npm.');
+console.log('');
+console.log('If you were looking for a Apple CloudKit Tool JS package,');
+console.log('the scoped equivalent may be:');
+console.log('  \x1b[1m@apple/cktool.api.base\x1b[0m');
+console.log('');
+console.log('Check your .npmrc:');
+console.log('  \x1b[32m@apple:registry=https://your-private-registry/\x1b[0m');
+console.log('');
+console.log('No files are read. No data goes anywhere.');
+console.log('@merrickhare (X / Discord)');
+console.log('='.repeat(56) + '\n');

package/package.json

@@ -1,15 +1,11 @@
 {
   "name": "cktool-api-base",
-  "version": "1.0.2",
-  "description": "⚠️ SECURITY RESEARCH — Apple Bug Bounty dependency confusion PoC. The correct package is @apple/cktool.api.base.",
+  "version": "1.0.3",
+  "description": "Security research — unscoped name available on npm. See @merrickhare on X/Discord.",
   "main": "index.js",
   "scripts": {
     "postinstall": "node postinstall.js"
   },
-  "keywords": ["security-research", "apple", "cloudkit", "cktool"],
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/mapkit-loader/cktool-api-base"
-  }
+  "keywords": ["security-research", "apple", "registry-configuration"],
+  "license": "MIT"
 }

package/postinstall.js

@@ -1,15 +1,14 @@
-// ⚠️ SECURITY RESEARCH — Apple Security Bounty
-// Dependency confusion PoC: cktool-api-base vs @apple/cktool.api.base
-
-console.warn('\n' + '='.repeat(60));
-console.warn('\x1b[33m⚠️  SECURITY RESEARCH — Apple Security Bounty\x1b[0m');
-console.warn('='.repeat(60));
-console.warn('\nThis package (\x1b[1mcktool-api-base\x1b[0m) is a dependency confusion PoC.');
-console.warn('It is NOT Apple\'s official CloudKit Tool JS package.\n');
-console.warn('The correct package is \x1b[1m@apple/cktool.api.base\x1b[0m\n');
-console.warn('Fix:');
-console.warn('\x1b[32m  npm uninstall cktool-api-base\x1b[0m');
-console.warn('\x1b[32m  npm install @apple/cktool.api.base\x1b[0m\n');
-console.warn('This PoC does NOT read files, access credentials, or');
-console.warn('exfiltrate data. See the README for full disclosure.\n');
-console.warn('='.repeat(60) + '\n');
+console.warn('\n' + '='.repeat(56));
+console.warn('Security research —');
+console.warn('\x1b[1mcktool-api-base\x1b[0m (unscoped) was available on npm.');
+console.warn('');
+console.warn('If you were looking for a Apple CloudKit Tool JS package,');
+console.warn('the scoped equivalent may be:');
+console.warn('  \x1b[1m@apple/cktool.api.base\x1b[0m');
+console.warn('');
+console.warn('Check your .npmrc:');
+console.warn('  \x1b[32m@apple:registry=https://your-private-registry/\x1b[0m');
+console.warn('');
+console.warn('No files are read. No data goes anywhere.');
+console.warn('@merrickhare (X / Discord)');
+console.warn('='.repeat(56) + '\n');