From 1ff6b5aea634d0eba12d8f83f837652fe70402ce Mon Sep 17 00:00:00 2001
From: Church of Malware <3+ek0ms@noreply.git.churchofmalware.org>
Date: Mon, 29 Jun 2026 16:50:24 +0000
Subject: [PATCH] Upload files to "lunar-modrinth-chain-poc/evidence"

---
 .../evidence/local-lnk-proof.md               | 37 +++++++++++++++++++
 1 file changed, 37 insertions(+)
 create mode 100644 lunar-modrinth-chain-poc/evidence/local-lnk-proof.md

diff --git a/lunar-modrinth-chain-poc/evidence/local-lnk-proof.md b/lunar-modrinth-chain-poc/evidence/local-lnk-proof.md
new file mode 100644
index 0000000..3261de7
--- /dev/null
+++ b/lunar-modrinth-chain-poc/evidence/local-lnk-proof.md
@@ -0,0 +1,37 @@
+# Local Launcher Proof
+
+Observed during local validation:
+
+```text
+Directory: work\lnk-proof
+
+marker.txt
+payload.lnk
+lnk-executed
+```
+
+Interpretation:
+
+- A local `.lnk` was created with a harmless marker target.
+- Opening the shortcut caused Windows to execute the target.
+- The marker file contained `lnk-executed`.
+
+This validates the final operating-system primitive used by the proposed Lunar
+chain. It does not prove the complete Lunar end-to-end exploit by itself.
+
+The repository now includes `poc/calc-pop.js`, a Node.js proof that performs a
+visible calculator pop using a local launcher file:
+
+- Windows: `.lnk` to `calc.exe`
+- macOS: `.command` running `open -a Calculator`
+- Linux: `.desktop` launcher for an installed calculator binary
+
+Observed output from the replacement PoC on Windows:
+
+```text
+> lunar-modrinth-chain-poc@0.1.0 poc
+> node poc/calc-pop.js
+
+marker: calc-pop-attempted
+opened: ...\poc\poc-output\calc-pop.lnk
+```