PHPackages                             jav333d/depconf-poc - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. jav333d/depconf-poc

ActiveLibrary

jav333d/depconf-poc
===================

Security research - Dependency confusion PoC demonstrating Packagist resolution with autoload code execution. Razer FIUU assessment (Inspectiv).

99.0.1(yesterday)05↑2900%MITPHPPHP >=5.6

Since Jul 23Pushed yesterdayCompare

[ Source](https://github.com/jav333d/depconf-poc)[ Packagist](https://packagist.org/packages/jav333d/depconf-poc)[ RSS](/packages/jav333d-depconf-poc/feed)WikiDiscussions master Synced today

READMEChangelogDependenciesVersions (3)Used By (0)

Dependency Confusion PoC — jav333d/depconf-poc
==============================================

[](#dependency-confusion-poc--jav333ddepconf-poc)

**Security Research Only** — Razer FIUU Bug Bounty (Inspectiv)

This package demonstrates that Composer's default behavior of checking Packagist.org allows an attacker to publish malicious packages that get installed when private package names are not claimed on the public registry.

- **Tester:** jaxjaveed (Inspectiv)
- **Program:** Razer FIUU
- **Mechanism:** post-install-cmd sends benign HTTP callback to webhook.site

###  Health Score

36

—

LowBetter than 79% of packages

Maintenance100

Actively maintained with recent releases

Popularity5

Limited adoption so far

Community2

Small or concentrated contributor base

Maturity29

Early-stage or recently created project

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~0 days

Total

2

Last Release

1d ago

### Community

Maintainers

![](https://avatars.githubusercontent.com/u/220512202?v=4)[jav333d](/maintainers/jav333d)[@jav333d](https://github.com/jav333d)

### Embed Badge

![Health badge](/badges/jav333d-depconf-poc/health.svg)

```
[![Health](https://phpackages.com/badges/jav333d-depconf-poc/health.svg)](https://phpackages.com/packages/jav333d-depconf-poc)
```

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)