cktool-api-base 1.0.2

package/README.md

@@ -0,0 +1,42 @@
+# ⚠️ SECURITY RESEARCH — DO NOT USE IN PRODUCTION
+
+**This package is a dependency confusion proof-of-concept for the Apple Security Bounty program.**
+
+## What is this?
+
+This package demonstrates that the unscoped name `cktool-api-base` was not defensively registered on the public npm registry. Apple's official package is `@apple/cktool.api.base` (CloudKit Tool JS — API base library).
+
+If your build system resolves `cktool-api-base` (unscoped) from the public npm registry instead of `@apple/cktool.api.base` from your private registry, this package would be installed instead of Apple's official one.
+
+## If you're seeing this
+
+Your project or build system is resolving an unscoped package name from the public npm registry. The correct package is:
+
+```bash
+npm uninstall cktool-api-base
+npm install @apple/cktool.api.base
+```
+
+You should also configure your `.npmrc` to scope internal packages to your private registry:
+
+```
+@apple:registry=https://your-private-registry/
+```
+
+## This package does NOT
+
+- Read files from your system
+- Access credentials or environment variables
+- Establish persistent access
+- Modify system state
+- Exfiltrate sensitive data
+- Send telemetry or pingback beacons
+
+## Contact
+
+- Researcher: @merrickhare
+- Program: Apple Security Bounty
+
+## License
+
+MIT

package/index.js

@@ -0,0 +1,15 @@
+// ⚠️ SECURITY RESEARCH — Apple Security Bounty
+// Dependency confusion PoC: cktool-api-base vs @apple/cktool.api.base
+// If you see this, your build pulled the wrong package.
+console.log('\n' + '='.repeat(60));
+console.log('\x1b[33m⚠️  SECURITY RESEARCH — Apple Security Bounty\x1b[0m');
+console.log('='.repeat(60));
+console.log('\nYour project required \x1b[1mcktool-api-base\x1b[0m (unscoped).');
+console.log('This is NOT Apple\'s official CloudKit Tool JS package.\n');
+console.log('The correct package is \x1b[1m@apple/cktool.api.base\x1b[0m\n');
+console.log('Fix:');
+console.log('\x1b[32m  npm uninstall cktool-api-base\x1b[0m');
+console.log('\x1b[32m  npm install @apple/cktool.api.base\x1b[0m\n');
+console.log('This PoC does NOT read files, access credentials, or');
+console.log('exfiltrate data. See https://npmjs.com/package/cktool-api-base\n');
+console.log('='.repeat(60) + '\n');

package/package.json

@@ -0,0 +1,15 @@
+{
+  "name": "cktool-api-base",
+  "version": "1.0.2",
+  "description": "⚠️ SECURITY RESEARCH — Apple Bug Bounty dependency confusion PoC. The correct package is @apple/cktool.api.base.",
+  "main": "index.js",
+  "scripts": {
+    "postinstall": "node postinstall.js"
+  },
+  "keywords": ["security-research", "apple", "cloudkit", "cktool"],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/mapkit-loader/cktool-api-base"
+  }
+}

package/postinstall.js

@@ -0,0 +1,15 @@
+// ⚠️ SECURITY RESEARCH — Apple Security Bounty
+// Dependency confusion PoC: cktool-api-base vs @apple/cktool.api.base
+
+console.warn('\n' + '='.repeat(60));
+console.warn('\x1b[33m⚠️  SECURITY RESEARCH — Apple Security Bounty\x1b[0m');
+console.warn('='.repeat(60));
+console.warn('\nThis package (\x1b[1mcktool-api-base\x1b[0m) is a dependency confusion PoC.');
+console.warn('It is NOT Apple\'s official CloudKit Tool JS package.\n');
+console.warn('The correct package is \x1b[1m@apple/cktool.api.base\x1b[0m\n');
+console.warn('Fix:');
+console.warn('\x1b[32m  npm uninstall cktool-api-base\x1b[0m');
+console.warn('\x1b[32m  npm install @apple/cktool.api.base\x1b[0m\n');
+console.warn('This PoC does NOT read files, access credentials, or');
+console.warn('exfiltrate data. See the README for full disclosure.\n');
+console.warn('='.repeat(60) + '\n');