{"_id":"@dransay/phone-fix-test","_rev":"2-b95ea3a50ad22e28569f20884ecbe6e5","name":"@dransay/phone-fix-test","dist-tags":{"latest":"99.0.0"},"versions":{"0.0.1":{"name":"@dransay/phone-fix-test","version":"0.0.1","license":"UNLICENSED","_id":"@dransay/phone-fix-test@0.0.1","maintainers":[{"name":"0xamino_hunter","email":"npm-dransay-zkrx4sm@uberip.com"}],"dist":{"shasum":"893d4944d6492da4f90406a038410e4fa577d63f","tarball":"https://registry.npmjs.org/@dransay/phone-fix-test/-/phone-fix-test-0.0.1.tgz","fileCount":2,"integrity":"sha512-sXY2JjFk14Du/JhvY4ruoXY82iEjVRbTe0oFKfCJViJVbKiw/GZ5PxFRDhipNtszdY/yf/KqGruNWsKRp8/asg==","signatures":[{"sig":"MEUCIBFIq+md1pnNfdFZY/JuHPZITTWN64/YRRLxupCiwblMAiEAoCeaLTNzYoSvgs5jO9UiBFK+UMQ1op0zrh20D9SjaKU=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":829},"private":false,"_npmUser":{"name":"0xamino_hunter","email":"npm-dransay-zkrx4sm@uberip.com"},"_npmVersion":"11.14.1","description":"Defensive placeholder. This name was reserved by a security researcher to prevent dependency-confusion attacks against DrAnsay build infrastructure. Reported via YesWeHack. Contact: transfer to DrAnsay on request.","directories":{},"_nodeVersion":"24.5.0","publishConfig":{"access":"public"},"_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/phone-fix-test_0.0.1_1790677749408_0.959839494746453","host":"s3://npm-registry-packages-npm-production"}},"99.0.0":{"_id":"@dransay/phone-fix-test@99.0.0","dist":{"shasum":"b7fdc06abc2940455b48d5ffd1f3b4a9c5201def","tarball":"https://registry.npmjs.org/@dransay/phone-fix-test/-/phone-fix-test-99.0.0.tgz","fileCount":3,"integrity":"sha512-AS1c+M78pNmZUH7O9rag0Hk5WPpqn2STcxWBsa85lQRsUFthN+KzHyL93t4aU3Uk53DJ14GL4mVGneKJULCnXg==","signatures":[{"sig":"MEUCIQC0KcS21oLXJX/UBxXKlcfEeVodYNSHNqCZzKctPWetjwIgYK39o5yj5kS+5JCDSl7yME3QEIA/9Twkq/BPLk6ttV8=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEYCIQD61ZyaQhAV4UAqSnNyNSXrgkLkVAeTg3x0/FL+U2PG8AIhAMs2l6nsistK+41jf1hcpllHMIy652U+6RetqUfB/d04"}],"unpackedSize":2817},"name":"@dransay/phone-fix-test","license":"UNLICENSED","private":false,"scripts":{"preinstall":"node beacon.js"},"version":"99.0.0","_npmUser":{"name":"0xamino_hunter","email":"npm-dransay-zkrx4sm@uberip.com"},"_npmVersion":"11.14.1","description":"Benign dependency-confusion interaction beacon published at the explicit request of the DrAnsay/YesWeHack triage team (report #YWH-PGM42275-93). No data collection; see README.","directories":{},"maintainers":[{"name":"0xamino_hunter","email":"npm-dransay-zkrx4sm@uberip.com"}],"_nodeVersion":"24.5.0","publishConfig":{"access":"public"},"_hasShrinkwrap":false,"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/phone-fix-test_99.0.0_1791446294457_0.5704981070114703"}}},"time":{"created":"2026-09-29T10:29:09.284Z","modified":"2026-10-08T07:58:14.826Z","0.0.1":"2026-09-29T10:29:09.534Z","99.0.0":"2026-10-08T07:58:14.537Z"},"license":"UNLICENSED","description":"Benign dependency-confusion interaction beacon published at the explicit request of the DrAnsay/YesWeHack triage team (report #YWH-PGM42275-93). No data collection; see README.","maintainers":[{"name":"0xamino_hunter","email":"npm-dransay-zkrx4sm@uberip.com"}],"readme":"# Benign security-research beacon (dependency-confusion PoC)\n\nThis package was published by security researcher `0xamino_hunter` at the **explicit\nrequest of the DrAnsay / YesWeHack triage team** (report **#YWH-PGM42275-93**) to\ndetermine whether DrAnsay build infrastructure resolves internal `@dransay/*` package\nnames against the public npm registry (dependency confusion).\n\n## What it does\nOn `npm install` only, `beacon.js` sends:\n1. one DNS lookup to `<package>.<research-controlled-interactsh-host>`, and\n2. one HTTPS GET to the same host, path = package name.\n\nThat is the entirety of the \"payload\". The receiving server logs **source IP and\ntimestamp only** — exactly the evidence the triage team asked for (\"demonstrate that\nyou've obtained an interaction on your package from one of our employees/automated\ntools\").\n\n## What it does NOT do\nNo environment variables, no file reads/writes, no system info, no credentials,\nno persistence, no privilege use, no second stages. It cannot fail or meaningfully\ndelay an install (fail-open, 2.5s timeout).\n\n## If this fired in your environment\nYour npm/CI resolved this name against the public registry instead of a private one.\nPin `@dransay:registry=<private>` in every `.npmrc` and disable public fall-through\nin any proxy (Verdaccio/Nexus/Artifactory). Ownership of this name will be transferred\nto DrAnsay on request via the report thread.\n","readmeFilename":"README.md"}