A dependency confusion package that runs on install

Remote code execution is the top of the ladder: making the server run code you chose. It usually arrives through something more modest — an upload that lands somewhere executable, a template that evaluates input, a deserialization gadget, an injection that reaches a shell — escalated until the process does your bidding.

This lab: A dependency confusion package that runs on install. Turn a foothold into commands running on the server itself.

Work it against your own copy of the target. When you have the flag, submit it below.

Chain a foothold into command execution on the server, and prove it by reading something only the server's own process can. Capture the flag from the host.