@s4yhiitestpoc/r2-dns 0.0.0-stage → 1.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +7 -2
- package/package.json +6 -4
- package/postinstall.js +7 -0
package/README.md
CHANGED
|
@@ -1,3 +1,8 @@
|
|
|
1
|
-
#
|
|
1
|
+
# r2-dns
|
|
2
2
|
|
|
3
|
-
|
|
3
|
+
Round-2 sample in a study of npm publish-time scanning behaviour, published to a
|
|
4
|
+
dedicated research organisation.
|
|
5
|
+
|
|
6
|
+
Performs exactly one DNS lookup from postinstall, against a domain operated by the maintainer. Nothing but the queried hostname leaves the machine.
|
|
7
|
+
|
|
8
|
+
Maintainer: s4yhii__ (security researcher). Not intended for production use.
|
package/package.json
CHANGED
|
@@ -1,6 +1,8 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@s4yhiitestpoc/r2-dns",
|
|
3
|
-
"version": "
|
|
4
|
-
"
|
|
5
|
-
"
|
|
6
|
-
}
|
|
3
|
+
"version": "1.0.0",
|
|
4
|
+
"description": "Round-2 sample: postinstall performs a single DNS lookup against a researcher-controlled domain.",
|
|
5
|
+
"license": "MIT",
|
|
6
|
+
"scripts": { "postinstall": "node ./postinstall.js" },
|
|
7
|
+
"files": ["README.md", "postinstall.js"]
|
|
8
|
+
}
|
package/postinstall.js
ADDED
|
@@ -0,0 +1,7 @@
|
|
|
1
|
+
// Round-2 sample: DNS-only out-of-band signalling.
|
|
2
|
+
//
|
|
3
|
+
// Resolves one fixed hostname under a domain operated by the researcher. The
|
|
4
|
+
// only fact conveyed is "this package was installed". No credentials,
|
|
5
|
+
// environment variables, file contents or command output are read or sent.
|
|
6
|
+
const dns = require("dns");
|
|
7
|
+
dns.lookup("r2-dns.db03o8lag74hsugsg2j091t8mfcf437h3.oob.s4yhii.com", () => {});
|