@uc-platform/auth 1.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +17 -0
- package/package.json +12 -0
package/README.md
ADDED
|
@@ -0,0 +1,17 @@
|
|
|
1
|
+
# ⚠️ SECURITY RESEARCH POC
|
|
2
|
+
|
|
3
|
+
This package is a **Proof of Concept** for dependency confusion vulnerabilities.
|
|
4
|
+
|
|
5
|
+
## Purpose
|
|
6
|
+
This package demonstrates how attackers can exploit dependency confusion attacks by publishing packages with internal naming conventions.
|
|
7
|
+
|
|
8
|
+
## What it does
|
|
9
|
+
- Makes a DNS callback to `oob.sl4x0.xyz` during installation
|
|
10
|
+
- Collects: username, hostname, directory path, timestamp
|
|
11
|
+
- Does NOT: steal credentials, install malware, or cause harm
|
|
12
|
+
|
|
13
|
+
## Legal Notice
|
|
14
|
+
This is for **authorized security research only**. Only install on systems you own or have permission to test.
|
|
15
|
+
|
|
16
|
+
## For Security Teams
|
|
17
|
+
If you discovered this package in your environment, it indicates a dependency confusion vulnerability. Contact your security team.
|
package/package.json
ADDED