Hackney.Core.JWT

Security Research PoC — Do Not Use

This NuGet package is a proof-of-concept for a confirmed dependency confusion vulnerability. It contains no malicious payload. During the consuming project's build it sends:

• whoami (current OS username)
• hostname (machine hostname)
• the package id + version
• platform + timestamp

…to a researcher-controlled webhook.site URL, then exits.

It does not read files, dump environment variables, attempt persistence, or do any further network activity. Build failures are suppressed so the host build is never broken.

If your build pulled this package by accident: the underlying vulnerability is that your project references a NuGet ID that the original maintainer never registered on nuget.org. Please flag it to the upstream project.

This package will be unlisted as soon as responsible disclosure to the affected project completes, or within 30 days of publication.

Researcher contact: open an issue at https://github.com/aydinnyunus/dependency-confusion-research