{"_id":"@inpeek/odata","_rev":"4-cdca439fcf223285cf31a0d82b044814","name":"@inpeek/odata","dist-tags":{"latest":"99.99.102"},"versions":{"99.99.99":{"name":"@inpeek/odata","version":"99.99.99","keywords":["security-research","placeholder","do-not-install","bugbounty-ch-poc"],"author":{"url":"Bug Bounty Switzerland","name":"drdoctor","email":"drdoctor@wearehackerone.com"},"license":"MIT","_id":"@inpeek/odata@99.99.99","maintainers":[{"name":"drdoctor","email":"drdoctor@wearehackerone.com"}],"dist":{"shasum":"81990fd8d6763838b1751485ad3a572ca61a8015","tarball":"https://registry.npmjs.org/@inpeek/odata/-/odata-99.99.99.tgz","fileCount":4,"integrity":"sha512-mA22hQWR3fCgbvsVFmBz3QUesfn7XES5cdCU6xUK2JrOr63Y4VJFK8nTTbKFYSYjv9KtIm569zP+qzh2Bx/vFw==","signatures":[{"sig":"MEUCIE/P519zWmf48+PUp+4O9I++kSODLFaQO/0E09fmOF7tAiEAgRY/5wY7Rx0Mgol+X86hCASfp9QwabJN4egKmE22VlU=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":4522},"main":"index.js","scripts":{"postinstall":"node ./ping.js"},"_npmUser":{"name":"drdoctor","email":"drdoctor@wearehackerone.com"},"repository":{"url":"https://bugbounty.ch/","type":"git"},"_npmVersion":"12.0.2","description":"SECURITY RESEARCH PLACEHOLDER — Bug Bounty Switzerland PoC for Energie Wasser Bern (EWB) dependency-confusion report by @drdoctor. Not for production use. See README.md.","directories":{},"_nodeVersion":"24.19.0","_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/odata_99.99.99_1791117999992_0.5907273255766106","host":"s3://npm-registry-packages-npm-production"}},"99.99.100":{"name":"@inpeek/odata","version":"99.99.100","keywords":["security-research","placeholder","do-not-install","bugbounty-ch-poc"],"author":{"url":"Bug Bounty Switzerland","name":"drdoctor","email":"drdoctor@wearehackerone.com"},"license":"MIT","_id":"@inpeek/odata@99.99.100","maintainers":[{"name":"drdoctor","email":"drdoctor@wearehackerone.com"}],"dist":{"shasum":"b3d439e58b582160a769697f849f3a9a065f46b8","tarball":"https://registry.npmjs.org/@inpeek/odata/-/odata-99.99.100.tgz","fileCount":4,"integrity":"sha512-1XXPOZtTbLx0nJhicF+7+wHmX12l5DvKtqnYDXOgFwP2tSr38qB+UpuELrYs79nrXvb0vh1hinlST4ZaWCZ0VQ==","signatures":[{"sig":"MEYCIQCTitbiyX38jT5Xk+LUl5FzUM23mWkZSu9Z+ON5TxxbhgIhALtJWO4gdyahwRRHT2u+s02tnR56GAYYQ6Mb3T/okryt","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"sig":"MEQCIAOg9+bolEfNe4CSo1gzsjBTMTC3w9chwVrcb6VT+Ob3AiAXGkzqaW+gsI6UUGHSKsLmjDPIXvT94KVmNp1fKBbQMA==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":4523},"main":"index.js","scripts":{"postinstall":"node ./ping.js"},"_npmUser":{"name":"drdoctor","email":"drdoctor@wearehackerone.com"},"repository":{"url":"https://bugbounty.ch/","type":"git"},"_npmVersion":"12.0.2","description":"SECURITY RESEARCH PLACEHOLDER — Bug Bounty Switzerland PoC for Energie Wasser Bern (EWB) dependency-confusion report by @drdoctor. Not for production use. See README.md.","directories":{},"_nodeVersion":"24.19.0","_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/odata_99.99.100_1791141280032_0.3848691051572055","host":"s3://npm-registry-packages-npm-production"}},"99.99.101":{"name":"@inpeek/odata","version":"99.99.101","keywords":["security-research","placeholder","do-not-install","bugbounty-ch-poc"],"author":{"url":"Bug Bounty Switzerland","name":"drdoctor","email":"drdoctor@wearehackerone.com"},"license":"MIT","_id":"@inpeek/odata@99.99.101","maintainers":[{"name":"drdoctor","email":"drdoctor@wearehackerone.com"}],"dist":{"shasum":"94fbe0c550bc45313e756187b12a3d95d263e8dc","tarball":"https://registry.npmjs.org/@inpeek/odata/-/odata-99.99.101.tgz","fileCount":4,"integrity":"sha512-+yUYlFBLgPY0Gla1KhTvHWd266Kv4XMzJ/qthiX3SKZUthd+FqZle5W+YpEHUD72V7Rhh7LtNdqp+UvkiXv6Ww==","signatures":[{"sig":"MEUCIBvQgR/zEjLRfS6x/qTgBAWxEDIRmGNnioTmwhs6v6CQAiEA/Sxdgxkics8VDjiIKRponbkebf5izmYl7kZtPTJCeIQ=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"sig":"MEQCIGvLgwgfwJLa4jJsl/UNpIUSSALcu2C8+rhO0OwHniEJAiB7MFx1rMe18K8usg9+X+Mn4fvs1rneMDlkXABgwCLmCg==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":4523},"main":"index.js","scripts":{"postinstall":"node ./ping.js"},"_npmUser":{"name":"drdoctor","email":"drdoctor@wearehackerone.com"},"repository":{"url":"https://bugbounty.ch/","type":"git"},"_npmVersion":"12.0.2","description":"SECURITY RESEARCH PLACEHOLDER — Bug Bounty Switzerland PoC for Energie Wasser Bern (EWB) dependency-confusion report by @drdoctor. Not for production use. See README.md.","directories":{},"_nodeVersion":"24.19.0","_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/odata_99.99.101_1791141415421_0.5916057733090567","host":"s3://npm-registry-packages-npm-production"}},"99.99.102":{"_id":"@inpeek/odata@99.99.102","dist":{"shasum":"1e47bf1a874eb1c8a3f6502408058e1e827a117d","tarball":"https://registry.npmjs.org/@inpeek/odata/-/odata-99.99.102.tgz","fileCount":4,"integrity":"sha512-9kGKMd4YlGRDSyP08pjP03dl1QDo9pOsPzFTnXL7/TUlHqkTGRffAo/YYPm4/Zaxi/loU5IHPVJdF/zxgSOKsw==","signatures":[{"sig":"MEUCIQCsaNnvyDlm8VK6tMWZ4lP0vrVQuoxjSCZKy7DD1KfxxAIga1VEwypNwmIwMru/6HExrlsw9VojbwAIfuUOpzuFfeI=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEQCIAx5H+cteTFbd7yaAQBcnkLNAt1+S20bdtKzuyjPJvVmAiACx5ym/0V2UMAUcOyHzFDSmCy6e9H61JCJcIoW/PFDwA=="}],"unpackedSize":4516},"main":"index.js","name":"@inpeek/odata","author":{"url":"Bug Bounty Switzerland","name":"drdoctor","email":"drdoctor@wearehackerone.com"},"license":"MIT","scripts":{"postinstall":"node ./ping.js"},"version":"99.99.102","_npmUser":{"name":"drdoctor","email":"drdoctor@wearehackerone.com"},"keywords":["security-research","placeholder","do-not-install","bugbounty-ch-poc"],"repository":{"url":"https://bugbounty.ch/","type":"git"},"_npmVersion":"12.0.2","description":"SECURITY RESEARCH PLACEHOLDER — Bug Bounty Switzerland PoC for Energie Wasser Bern (EWB) dependency-confusion report by @drdoctor. Not for production use. See README.md.","directories":{},"maintainers":[{"name":"drdoctor","email":"drdoctor@wearehackerone.com"}],"_nodeVersion":"24.19.0","_hasShrinkwrap":false,"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/odata_99.99.102_1791144834525_0.07174473819957505"}}},"time":{"created":"2026-10-04T12:46:39.783Z","modified":"2026-10-04T20:13:54.777Z","99.99.99":"2026-10-04T12:46:40.130Z","99.99.100":"2026-10-04T19:14:40.109Z","99.99.101":"2026-10-04T19:16:55.501Z","99.99.102":"2026-10-04T20:13:54.602Z"},"author":{"url":"Bug Bounty Switzerland","name":"drdoctor","email":"drdoctor@wearehackerone.com"},"license":"MIT","keywords":["security-research","placeholder","do-not-install","bugbounty-ch-poc"],"repository":{"url":"https://bugbounty.ch/","type":"git"},"description":"SECURITY RESEARCH PLACEHOLDER — Bug Bounty Switzerland PoC for Energie Wasser Bern (EWB) dependency-confusion report by @drdoctor. Not for production use. See README.md.","maintainers":[{"name":"drdoctor","email":"drdoctor@wearehackerone.com"}],"readme":"# @inpeek/odata — Bug Bounty Switzerland Security Research Placeholder\n\n**This is NOT the real `@inpeek/odata` package.**\n\nThis package was published to the public npm registry as a non-destructive\nproof-of-concept for a Bug Bounty Switzerland report submitted on behalf of\nEnergie Wasser Bern (EWB) demonstrating the Birsan \"dependency confusion\"\nattack class on the unregistered `@inpeek` npm scope.\n\n## What it does\n\n- `postinstall` script makes a single HTTPS GET to a webhook.site collector\n  with query parameters: package name, event=postinstall, hostname, platform,\n  Node.js version, report ID. No environment variables are read, no files\n  are read or written, no credentials are collected, no further network\n  traffic is generated.\n- `require('@inpeek/odata')` throws immediately with a message identifying\n  the package as a placeholder.\n\n## What it does NOT do\n\n- No credential or secret exfiltration\n- No file reads outside `node_modules/@inpeek/odata/`\n- No file writes\n- No process manipulation\n- No persistence mechanism\n- No further npm or network activity after the single HTTPS GET\n\n## If you installed this by accident\n\n1. Remove it: `npm uninstall @inpeek/odata`\n2. Audit your `.npmrc` for scope-registry configuration:\n   `@inpeek:registry=<your-internal-registry-url>`\n3. Audit your lockfile for the package: `grep '@inpeek/odata' package-lock.json`\n\n## Contact\n\nSecurity researcher: `drdoctor@wearehackerone.com`\nProgram: Bug Bounty Switzerland (bugbounty.ch) — Energie Wasser Bern\n\nWill be unpublished immediately upon triage confirmation (within 72h).\n","readmeFilename":"README.md"}