This is a coordinated-disclosure proof-of-concept for a dependency-confusion finding. It is not a real package and should not be installed by anyone.

If you reached this page unexpectedly, you can ignore and delete it. It performs no harmful action — see Exactly what it does below.

Researcher contact: <fill in your handle / report reference>

The finding (for the program owner)

Dependency confusion occurs when a build pipeline is configured to resolve packages from the public index in addition to (or ahead of) a private/ internal index. If an internal package named vinted-mocked-apis exists and the same name is unclaimed on the public index, a public package published under that name — with a higher version — can be pulled and executed in the internal build/runtime environment instead of the intended private one.

This PoC demonstrates code execution in your environment, which is the core impact. It does not attempt to steal anything.

Exactly what it does

On pip install (via setup.py install hooks) and on import, it fires a single best-effort, fail-silent callback to a researcher-controlled collaborator host carrying only:

a pre-registered nonce (cited in the report, so the hit is attributable),
the machine hostname (so you can confirm which host executed it),
the literal label SECURITY-POC-DO-NOT-INSTALL.

That is the entire payload.

What it deliberately does NOT do

No environment variables, secrets, tokens, or credentials are read or sent.
No filesystem access, no directory listing, no source-code exfiltration.
No persistence, no shell, no process spawning, no host modification.
No network destination other than the researcher's collaborator host.
A failed callback never breaks the install or the importing process.

Reproducing the proof

Set COLLABORATOR_HOST and POC_NONCE in src/vinted_mocked_apis/beacon.py to your own interactsh/Collaborator values.
Build: python -m build
In a disposable environment that mirrors the affected resolver config, pip install vinted-mocked-apis.
Observe the DNS/HTTP interaction arriving at your collaborator, tagged with the nonce and hostname.

The arrival of that single tagged callback is the proof of execution.

Validity preconditions (confirm before reporting)

vinted-mocked-apis (or whatever the exact internal name is) is actually referenced privately by the target.
The name is unclaimed on the public index (publishing a name they don't use is squatting, not a valid finding).
The target's resolver config actually allows public fallback for that name.