> For the complete documentation index, see [llms.txt](https://kabinet.gitbook.io/ctf-writeup/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kabinet.gitbook.io/ctf-writeup/2025/defcon-cloud-village-2025/purrlock-cafe.md).

# Purrlock Cafe

<figure><img src="/files/XyfbGgcEVfmdUJx9rQVX" alt=""><figcaption></figcaption></figure>

Viewing the commit history, we noticed a mention regarding security incident.

<figure><img src="/files/eoDqvlsdaHMfGsvmLYle" alt=""><figcaption></figcaption></figure>

Viewing the activity, we found a force push request.

<figure><img src="/files/YBpt9743CYkA7zgQ2MS2" alt=""><figcaption></figcaption></figure>

Looking at the [initial commit](https://github.com/cloud-village/purrlock-cafe/commit/c32fe6374905ff7c3c3e989f5b67afd8bb4f8dc7#diff-cdf66b83cb3a7afa14c4d56b91f257b7c4c874cb96e9d63644f69f89907894b2R1-R13), we found a google cloud service account key.

<figure><img src="/files/JEMPAdtrvaA6QI0zcigX" alt=""><figcaption></figcaption></figure>

The servuce account name is npm-reader. Looking at the package-lock.json, theres a reference to artifact registry.

<figure><img src="/files/WUPxbtBGfd79WZgVZ8jh" alt=""><figcaption></figcaption></figure>

Following the artifact regsitry documentation, we are able to authenticate and pull the packages.

{% embed url="<https://cloud.google.com/artifact-registry/docs/nodejs/authentication>" %}

Looking at the postinstall.js of the secrets menu, we see a reference to a secrets in google cloud secrets manager, as well as a base64 encoded service account.

<figure><img src="/files/NUg4ITSuAbkLoc9LEy0h" alt=""><figcaption></figcaption></figure>

We are then able to authenticate and retrieve the flag.

<figure><img src="/files/MEMKCMGRmnE0cB4WLRWy" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/fIWQI6tZA8Yjxs3Hizfg" alt=""><figcaption></figcaption></figure>