Metadata-Version: 2.4
Name: osm-tag-mapper
Version: 0.0.1
Summary: DEPENDENCY CONFUSION PoC - TomTom Internal Package Takeover
License: Apache-2.0
Description-Content-Type: text/markdown

# 🚨 DEPENDENCY CONFUSION - PoC Takeover

This package did **not exist** on PyPI.

The official TomTom International GitHub repository [tomtom-international/osm_tag_mapper](https://github.com/tomtom-international/osm_tag_mapper) instructs users and internal teams to install via:

```
pip install osm-tag-mapper
```

But `osm-tag-mapper` was **never published** to PyPI — until now.

---

## 🔴 Takeover by l0bo

This package was claimed as a **Proof of Concept** to demonstrate the dependency confusion vulnerability in TomTom International's open source project.

Any developer, CI/CD pipeline, or internal team following the README instructions would install this package from the **public PyPI registry** instead of a private/controlled source — giving an attacker full control over what code gets executed.

**HackerOne:** [@l0bo](https://hackerone.com/l0bo) / wearehackerone

---

### What could an attacker do?
- Steal environment variables, API keys, SSH keys
- Inject backdoors into TomTom's internal systems
- Exfiltrate source code and proprietary data
- Spread malware across developer machines and build servers

### Why this matters
The GitHub repo has **public traffic** and is linked from TomTom's organization — meaning internal teams, external contributors, and automated build systems all see `pip install osm-tag-mapper` as the recommended install method.

**This is not theoretical. This package was claimed within minutes of discovery.**

---

*⚠️ This is a responsible disclosure proof of concept. No malicious code has been executed. The package was claimed only to demonstrate the vulnerability.*
