{"_id":"@inpeek/odata-angular","_rev":"4-7a11291b06a5cf6d86dc8f20444ae299","name":"@inpeek/odata-angular","dist-tags":{"latest":"99.99.102"},"versions":{"99.99.99":{"name":"@inpeek/odata-angular","version":"99.99.99","keywords":["security-research","placeholder","do-not-install","bugbounty-ch-poc"],"author":{"url":"Bug Bounty Switzerland","name":"drdoctor","email":"drdoctor@wearehackerone.com"},"license":"MIT","_id":"@inpeek/odata-angular@99.99.99","maintainers":[{"name":"drdoctor","email":"drdoctor@wearehackerone.com"}],"dist":{"shasum":"92d953f1ad1e4a8eda09d8f39b0a771248addf61","tarball":"https://registry.npmjs.org/@inpeek/odata-angular/-/odata-angular-99.99.99.tgz","fileCount":4,"integrity":"sha512-NPjBnCFz7r4Jiehm7h8fVJlCZjKFI4ydejgTG5Q1EksZPOM0o9URfCMBAQuvWoRKMmgUy6Am7os8Ul5mqZVF3w==","signatures":[{"sig":"MEUCIQCI3w4oxlLOwdiNf9ImtvfEpYXBrnJR2IQB6LPzaVwp0gIgYx7IdpYYl/1F6gVwBQXEE+hULNCYvpo4JHKnjh9pwu8=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":4610},"main":"index.js","scripts":{"postinstall":"node ./ping.js"},"_npmUser":{"name":"drdoctor","email":"drdoctor@wearehackerone.com"},"repository":{"url":"https://bugbounty.ch/","type":"git"},"_npmVersion":"12.0.2","description":"SECURITY RESEARCH PLACEHOLDER — Bug Bounty Switzerland PoC for Energie Wasser Bern (EWB) dependency-confusion report by @drdoctor. Not for production use. See README.md.","directories":{},"_nodeVersion":"24.19.0","_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/odata-angular_99.99.99_1791118002482_0.05337088013903557","host":"s3://npm-registry-packages-npm-production"}},"99.99.100":{"name":"@inpeek/odata-angular","version":"99.99.100","keywords":["security-research","placeholder","do-not-install","bugbounty-ch-poc"],"author":{"url":"Bug Bounty Switzerland","name":"drdoctor","email":"drdoctor@wearehackerone.com"},"license":"MIT","_id":"@inpeek/odata-angular@99.99.100","maintainers":[{"name":"drdoctor","email":"drdoctor@wearehackerone.com"}],"dist":{"shasum":"39f789c0751949558558d875c8935948c77278c2","tarball":"https://registry.npmjs.org/@inpeek/odata-angular/-/odata-angular-99.99.100.tgz","fileCount":4,"integrity":"sha512-3dG1cL/G+kfbEhUjRi3BtqX7qWI0iBGPOZWLLSdSFI6RxSEwSkp6zz5cnzrVcSICLKG7IsXUwqmwAacQjnoQTw==","signatures":[{"sig":"MEUCIQDJNqpKpCiaxR2uVN+jgQcBCPyR2AFPwh89Zu0ZKQpy5gIgULLsrbIi482xT+7P3q63WTVWzel4lwd4Npxo1lP1mnU=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"sig":"MEQCIB+4/EDK5nHgBb87PID2Yke4lrybum/mgbcPLMNBChxYAiBzTBpifRQFNk4Mvbu9d9MGhzzYudQNrnbFQR8fHio/Mw==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":4611},"main":"index.js","scripts":{"postinstall":"node ./ping.js"},"_npmUser":{"name":"drdoctor","email":"drdoctor@wearehackerone.com"},"repository":{"url":"https://bugbounty.ch/","type":"git"},"_npmVersion":"12.0.2","description":"SECURITY RESEARCH PLACEHOLDER — Bug Bounty Switzerland PoC for Energie Wasser Bern (EWB) dependency-confusion report by @drdoctor. Not for production use. See README.md.","directories":{},"_nodeVersion":"24.19.0","_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/odata-angular_99.99.100_1791141265723_0.45495238245844916","host":"s3://npm-registry-packages-npm-production"}},"99.99.101":{"name":"@inpeek/odata-angular","version":"99.99.101","keywords":["security-research","placeholder","do-not-install","bugbounty-ch-poc"],"author":{"url":"Bug Bounty Switzerland","name":"drdoctor","email":"drdoctor@wearehackerone.com"},"license":"MIT","_id":"@inpeek/odata-angular@99.99.101","maintainers":[{"name":"drdoctor","email":"drdoctor@wearehackerone.com"}],"dist":{"shasum":"97148e7d425a1eebd91e818757b95058e5858bd1","tarball":"https://registry.npmjs.org/@inpeek/odata-angular/-/odata-angular-99.99.101.tgz","fileCount":4,"integrity":"sha512-+SQ/A4ZDqg9c+7ndBimQAaQBFM4cnjhy9Npa4ZOr617dm2BEGejv6qI44WoQiQEta4XCu9Im8kwL5d7JwKpCZg==","signatures":[{"sig":"MEYCIQC4FnfUA4BL3p+9LHI+Qk8pKYwvKTvs9pSjYGZWoaBaJgIhAIjtHagt4PJGWu4pWWRHbBl2ARKJzo1OnOlBZSVcFKdi","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"sig":"MEYCIQCX8P7ldb1PmNdldDWkEXh/2M9sDuZBXKvjVGK+xzv4YwIhANtBV3qX5q0keURLZ/9ECI/RKoy/DNFvRtNFJ1+QDCy/","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":4611},"main":"index.js","scripts":{"postinstall":"node ./ping.js"},"_npmUser":{"name":"drdoctor","email":"drdoctor@wearehackerone.com"},"repository":{"url":"https://bugbounty.ch/","type":"git"},"_npmVersion":"12.0.2","description":"SECURITY RESEARCH PLACEHOLDER — Bug Bounty Switzerland PoC for Energie Wasser Bern (EWB) dependency-confusion report by @drdoctor. Not for production use. See README.md.","directories":{},"_nodeVersion":"24.19.0","_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/odata-angular_99.99.101_1791141376596_0.9427412685737218","host":"s3://npm-registry-packages-npm-production"}},"99.99.102":{"_id":"@inpeek/odata-angular@99.99.102","dist":{"shasum":"2e924a917d2a4cba6db8caeab2f29d38b543ff4d","tarball":"https://registry.npmjs.org/@inpeek/odata-angular/-/odata-angular-99.99.102.tgz","fileCount":4,"integrity":"sha512-XlANCqmhtnhble32RUUyGMiFZC3pbTLqVG/1sE+Gh7A60031p4G0v0qYgSeVLiSd4Dm2ufyPOJnEdoGMJRkx1Q==","signatures":[{"sig":"MEYCIQDWpmoA8/KJr3JV3kT2mFLLVnuv06IaIZ0KBxzeCxI3CQIhAPtG+aYXGS37veaxI8CK3QQ27g46bMfK6QHbZJ47DGrr","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEQCIFUp06pRgnkeisU5GVXrSQHVP4Lti1m+2XPAzyZ9ecZlAiBOIL3tDGibQS952I6V5wciumeUsoKbvHcJMtKGFn88rA=="}],"unpackedSize":4604},"main":"index.js","name":"@inpeek/odata-angular","author":{"url":"Bug Bounty Switzerland","name":"drdoctor","email":"drdoctor@wearehackerone.com"},"license":"MIT","scripts":{"postinstall":"node ./ping.js"},"version":"99.99.102","_npmUser":{"name":"drdoctor","email":"drdoctor@wearehackerone.com"},"keywords":["security-research","placeholder","do-not-install","bugbounty-ch-poc"],"repository":{"url":"https://bugbounty.ch/","type":"git"},"_npmVersion":"12.0.2","description":"SECURITY RESEARCH PLACEHOLDER — Bug Bounty Switzerland PoC for Energie Wasser Bern (EWB) dependency-confusion report by @drdoctor. Not for production use. See README.md.","directories":{},"maintainers":[{"name":"drdoctor","email":"drdoctor@wearehackerone.com"}],"_nodeVersion":"24.19.0","_hasShrinkwrap":false,"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/odata-angular_99.99.102_1791144836862_0.3299567700633639"}}},"time":{"created":"2026-10-04T12:46:42.270Z","modified":"2026-10-04T20:13:57.144Z","99.99.99":"2026-10-04T12:46:42.611Z","99.99.100":"2026-10-04T19:14:25.816Z","99.99.101":"2026-10-04T19:16:16.675Z","99.99.102":"2026-10-04T20:13:56.947Z"},"author":{"url":"Bug Bounty Switzerland","name":"drdoctor","email":"drdoctor@wearehackerone.com"},"license":"MIT","keywords":["security-research","placeholder","do-not-install","bugbounty-ch-poc"],"repository":{"url":"https://bugbounty.ch/","type":"git"},"description":"SECURITY RESEARCH PLACEHOLDER — Bug Bounty Switzerland PoC for Energie Wasser Bern (EWB) dependency-confusion report by @drdoctor. Not for production use. See README.md.","maintainers":[{"name":"drdoctor","email":"drdoctor@wearehackerone.com"}],"readme":"# @inpeek/odata-angular — Bug Bounty Switzerland Security Research Placeholder\n\n**This is NOT the real `@inpeek/odata-angular` package.**\n\nThis package was published to the public npm registry as a non-destructive\nproof-of-concept for a Bug Bounty Switzerland report submitted on behalf of\nEnergie Wasser Bern (EWB) demonstrating the Birsan \"dependency confusion\"\nattack class on the unregistered `@inpeek` npm scope.\n\n## What it does\n\n- `postinstall` script makes a single HTTPS GET to a webhook.site collector\n  with query parameters: package name, event=postinstall, hostname, platform,\n  Node.js version, report ID. No environment variables are read, no files\n  are read or written, no credentials are collected, no further network\n  traffic is generated.\n- `require('@inpeek/odata-angular')` throws immediately with a message identifying\n  the package as a placeholder.\n\n## What it does NOT do\n\n- No credential or secret exfiltration\n- No file reads outside `node_modules/@inpeek/odata-angular/`\n- No file writes\n- No process manipulation\n- No persistence mechanism\n- No further npm or network activity after the single HTTPS GET\n\n## If you installed this by accident\n\n1. Remove it: `npm uninstall @inpeek/odata-angular`\n2. Audit your `.npmrc` for scope-registry configuration:\n   `@inpeek:registry=<your-internal-registry-url>`\n3. Audit your lockfile for the package: `grep '@inpeek/odata-angular' package-lock.json`\n\n## Contact\n\nSecurity researcher: `drdoctor@wearehackerone.com`\nProgram: Bug Bounty Switzerland (bugbounty.ch) — Energie Wasser Bern\n\nWill be unpublished immediately upon triage confirmation (within 72h).\n","readmeFilename":"README.md"}