Hackney.Core.JWT
Advanced tools
SECURITY RESEARCH PoC for a confirmed dependency confusion vulnerability. Sends only whoami+hostname to a researcher-controlled webhook.site URL during build. No file access, no env dump, no persistence. Will be unlisted after responsible disclosure. DO NOT USE.
This NuGet package is a proof-of-concept for a confirmed dependency confusion vulnerability. It contains no malicious payload. During the consuming project's build it sends:
whoami (current OS username)hostname (machine hostname)…to a researcher-controlled webhook.site URL, then exits.
It does not read files, dump environment variables, attempt persistence, or do any further network activity. Build failures are suppressed so the host build is never broken.
If your build pulled this package by accident: the underlying vulnerability is
that your project references a NuGet ID that the original maintainer never
registered on nuget.org. Please flag it to the upstream project.
This package will be unlisted as soon as responsible disclosure to the affected project completes, or within 30 days of publication.
Researcher contact: open an issue at https://github.com/aydinnyunus/dependency-confusion-research
FAQs
SECURITY RESEARCH PoC for a confirmed dependency confusion vulnerability. Sends only whoami+hostname to a researcher-controlled webhook.site URL during build. No file access, no env dump, no persistence. Will be unlisted after responsible disclosure. DO NOT USE.
We found that Hackney.Core.JWT demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Security News
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.
Security News
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.
Threat Research
/Security News
A supply chain attack compromised LiteLLM 1.107.0 on PyPI and Docker, spreading malware that steals cloud credentials, developer secrets, and AI provider keys.