Search by

jav333d / depconf-poc

jav333d

Versions of this package have been flagged as malware by Aikido!

Security research - Dependency confusion PoC demonstrating Packagist resolution with autoload code execution. Razer FIUU assessment (Inspectiv).

Package info

github.com/jav333d/depconf-poc

pkg:composer/jav333d/depconf-poc

Security

Advisories: 0

Aikido package health analysis

Transparency log

Statistics

Installs: 6

Dependents: 0

Suggesters: 0

Stars: 0

Open Issues: 0

99.0.1 2026-07-23 05:50 UTC

Requires

  • php: >=5.6

Requires (Dev)

None

Suggests

None

Provides

None

Conflicts

None

Replaces

None

MIT 08be35e37751e6da89052382751bb41c0eaaf81d

  • jaxjaveed <shaikmdjaveedafrose.woop@gmail.com>

Published on Packagist.org on 2026-07-23 05:50 UTC

This package is auto-updated.

Last update: 2026-09-23 06:08:38 UTC

README

Security Research Only — Razer FIUU Bug Bounty (Inspectiv)

This package demonstrates that Composer's default behavior of checking Packagist.org allows an attacker to publish malicious packages that get installed when private package names are not claimed on the public registry.

  • Tester: jaxjaveed (Inspectiv)
  • Program: Razer FIUU
  • Mechanism: post-install-cmd sends benign HTTP callback to webhook.site