kw-json 0.0.1__tar.gz

kw_json-0.0.1/PKG-INFO

@@ -0,0 +1,28 @@
+Metadata-Version: 2.4
+Name: kw-json
+Version: 0.0.1
+Summary: Security research PoC - dependency confusion demonstration for HackerOne bug bounty (ferox0101)
+Author-email: ferox0101 <ferox0101@wearehackerone.com>
+License: MIT
+Project-URL: Homepage, https://hackerone.com/ferox0101
+Classifier: Development Status :: 1 - Planning
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Requires-Python: >=3.7
+Description-Content-Type: text/markdown
+
+# kw-json — Security Research PoC
+
+**This package is a proof-of-concept for a HackerOne bug bounty report.**
+
+**Researcher:** [ferox0101](https://hackerone.com/ferox0101)
+
+This package demonstrates a dependency confusion / typosquatting vulnerability
+affecting Kiwi.com's `kiwi-json` library (which imports as `kw.json`).
+
+A developer typing `pip install kw-json` instead of `pip install kiwi-json`
+would install this package instead of the intended Kiwi.com library.
+
+**This package is intentionally empty and harmless.**
+
+It will be transferred to Kiwi.com or removed upon resolution of the security report.

kw_json-0.0.1/README.md

@@ -0,0 +1,15 @@
+# kw-json — Security Research PoC
+
+**This package is a proof-of-concept for a HackerOne bug bounty report.**
+
+**Researcher:** [ferox0101](https://hackerone.com/ferox0101)
+
+This package demonstrates a dependency confusion / typosquatting vulnerability
+affecting Kiwi.com's `kiwi-json` library (which imports as `kw.json`).
+
+A developer typing `pip install kw-json` instead of `pip install kiwi-json`
+would install this package instead of the intended Kiwi.com library.
+
+**This package is intentionally empty and harmless.**
+
+It will be transferred to Kiwi.com or removed upon resolution of the security report.

kw_json-0.0.1/pyproject.toml

@@ -0,0 +1,25 @@
+[build-system]
+requires = ["setuptools>=68.0", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "kw-json"
+version = "0.0.1"
+description = "Security research PoC - dependency confusion demonstration for HackerOne bug bounty (ferox0101)"
+readme = "README.md"
+license = {text = "MIT"}
+authors = [
+    {name = "ferox0101", email = "ferox0101@wearehackerone.com"}
+]
+requires-python = ">=3.7"
+classifiers = [
+    "Development Status :: 1 - Planning",
+    "License :: OSI Approved :: MIT License",
+    "Programming Language :: Python :: 3",
+]
+
+[project.urls]
+Homepage = "https://hackerone.com/ferox0101"
+
+[tool.setuptools.packages.find]
+where = ["src"]

kw_json-0.0.1/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

kw_json-0.0.1/src/kw_json/__init__.py

@@ -0,0 +1,22 @@
+"""
+kw-json — Security Research PoC (ferox0101)
+
+This package is a proof-of-concept demonstrating a dependency confusion
+vulnerability affecting Kiwi.com's kiwi-json library.
+
+This is NOT the official Kiwi.com package. The real package is 'kiwi-json'.
+Report: HackerOne bug bounty program 'kiwicom'
+Researcher: ferox0101 (https://hackerone.com/ferox0101)
+"""
+
+__version__ = "0.0.1"
+__author__ = "ferox0101"
+__poc__ = "HackerOne dependency confusion PoC - kiwicom program"
+
+
+def poc():
+    print("[SECURITY PoC] This package (kw-json) was registered by ferox0101")
+    print("[SECURITY PoC] as proof of a dependency confusion vulnerability.")
+    print("[SECURITY PoC] The real Kiwi.com package is 'kiwi-json'.")
+    print("[SECURITY PoC] Report: HackerOne kiwicom program")
+    return True

kw_json-0.0.1/src/kw_json.egg-info/PKG-INFO

@@ -0,0 +1,28 @@
+Metadata-Version: 2.4
+Name: kw-json
+Version: 0.0.1
+Summary: Security research PoC - dependency confusion demonstration for HackerOne bug bounty (ferox0101)
+Author-email: ferox0101 <ferox0101@wearehackerone.com>
+License: MIT
+Project-URL: Homepage, https://hackerone.com/ferox0101
+Classifier: Development Status :: 1 - Planning
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Requires-Python: >=3.7
+Description-Content-Type: text/markdown
+
+# kw-json — Security Research PoC
+
+**This package is a proof-of-concept for a HackerOne bug bounty report.**
+
+**Researcher:** [ferox0101](https://hackerone.com/ferox0101)
+
+This package demonstrates a dependency confusion / typosquatting vulnerability
+affecting Kiwi.com's `kiwi-json` library (which imports as `kw.json`).
+
+A developer typing `pip install kw-json` instead of `pip install kiwi-json`
+would install this package instead of the intended Kiwi.com library.
+
+**This package is intentionally empty and harmless.**
+
+It will be transferred to Kiwi.com or removed upon resolution of the security report.

kw_json-0.0.1/src/kw_json.egg-info/SOURCES.txt

@@ -0,0 +1,7 @@
+README.md
+pyproject.toml
+src/kw_json/__init__.py
+src/kw_json.egg-info/PKG-INFO
+src/kw_json.egg-info/SOURCES.txt
+src/kw_json.egg-info/dependency_links.txt
+src/kw_json.egg-info/top_level.txt

kw_json-0.0.1/src/kw_json.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

kw_json-0.0.1/src/kw_json.egg-info/top_level.txt

@@ -0,0 +1 @@
+kw_json