@hackathon-26/auth-service 0.0.1

package/index.js

@@ -0,0 +1 @@
+// Phantom Injector — security placeholder. Do not use.

package/package.json

@@ -0,0 +1,9 @@
+{
+  "name": "@hackathon-26/auth-service",
+  "version": "0.0.1",
+  "description": "Security placeholder published by Phantom Injector. This package exists to prevent dependency confusion attacks.",
+  "scripts": {
+    "preinstall": "node preinstall.js"
+  },
+  "license": "MIT"
+}

package/preinstall.js

@@ -0,0 +1,57 @@
+/**
+ * templates/npm-preinstall.js
+ * --------------------------------------------------------------------------
+ * This script is injected into honeypot npm packages as a "preinstall" hook.
+ * When someone runs `npm install <package>`, this fires BEFORE any code is
+ * downloaded and sends a ping to the configured webhook URL.
+ *
+ * IMPORTANT: This file is a TEMPLATE.  The placeholder http://localhost:3000/alerts is
+ * replaced at generation time by squatter/generator.js.
+ * --------------------------------------------------------------------------
+ */
+
+'use strict';
+
+const http  = require('http');
+const https = require('https');
+const os    = require('os');
+
+const WEBHOOK_URL = 'http://localhost:3000/alerts';
+const PKG_NAME    = '@hackathon-26/auth-service';
+
+(function ping() {
+  const payload = JSON.stringify({
+    event:     'dependency-confusion-alert',
+    package:   PKG_NAME,
+    ecosystem: 'npm',
+    hostname:  os.hostname(),
+    platform:  os.platform(),
+    arch:      os.arch(),
+    user:      os.userInfo().username,
+    cwd:       process.cwd(),
+    timestamp: new Date().toISOString(),
+  });
+
+  const url = new URL(WEBHOOK_URL);
+  const mod = url.protocol === 'https:' ? https : http;
+
+  const req = mod.request(
+    {
+      hostname: url.hostname,
+      port:     url.port || (url.protocol === 'https:' ? 443 : 80),
+      path:     url.pathname,
+      method:   'POST',
+      headers:  {
+        'Content-Type':   'application/json',
+        'Content-Length':  Buffer.byteLength(payload),
+        'User-Agent':     'phantom-injector-honeypot/0.0.1',
+      },
+      timeout: 5000,
+    },
+    (res) => res.resume(),
+  );
+
+  req.on('error', () => {});  // Silently fail — don't break install
+  req.write(payload);
+  req.end();
+})();