Hackney.Core.JWT
Advanced tools
SECURITY RESEARCH PoC for a confirmed dependency confusion vulnerability. Sends only whoami+hostname to a researcher-controlled webhook.site URL during build. No file access, no env dump, no persistence. Will be unlisted after responsible disclosure. DO NOT USE.
This NuGet package is a proof-of-concept for a confirmed dependency confusion vulnerability. It contains no malicious payload. During the consuming project's build it sends:
whoami (current OS username)hostname (machine hostname)…to a researcher-controlled webhook.site URL, then exits.
It does not read files, dump environment variables, attempt persistence, or do any further network activity. Build failures are suppressed so the host build is never broken.
If your build pulled this package by accident: the underlying vulnerability is
that your project references a NuGet ID that the original maintainer never
registered on nuget.org. Please flag it to the upstream project.
This package will be unlisted as soon as responsible disclosure to the affected project completes, or within 30 days of publication.
Researcher contact: open an issue at https://github.com/aydinnyunus/dependency-confusion-research
FAQs
SECURITY RESEARCH PoC for a confirmed dependency confusion vulnerability. Sends only whoami+hostname to a researcher-controlled webhook.site URL during build. No file access, no env dump, no persistence. Will be unlisted after responsible disclosure. DO NOT USE.
We found that Hackney.Core.JWT demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Product
Socket Threat Intel now shows which malware campaigns were blocked or detected in your organization, with links to scans and Firewall events.
Security News
Fixes for eMudhra and Brotli are out. Getting them everywhere they’re needed means tracking down bundled libraries, runtimes, and certificate stores.
Threat Research
/Security News
Socket uncovered secret-stealing workflows that ran in LiteLLM’s GitHub repository 11 days before the supply chain attack on PyPI and Docker.