@securihackbot/gobimbel-core 0.0.0-stage → 1.0.0

package/README.md

@@ -1,3 +1,12 @@
-# Temporary Holding Version
+# Dependency-confusion PoC (authorized research)
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Source spec: `@gobimbel/core@1.0.0`
+Published as: `@securihackbot/gobimbel-core@1.0.0`
+Finding: https://hackbot.securi.web.id/#/engagements/2026-10-18-190010-ganeshaoperation-com?tab=findings&finding=VA-030
+
+Registry-takeover proof only: no install hooks are generated. The
+dependency-confusion finding stops at the finding notification.
+
+```sh
+npm publish --access public
+```

package/index.js

@@ -0,0 +1,2 @@
+// Inert entry point: the PoC only needs the install-time callback.
+module.exports = {};

package/package.json

@@ -1,6 +1,17 @@
 {
   "name": "@securihackbot/gobimbel-core",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.0.0",
+  "description": "Dependency-confusion research PoC (authorized).",
+  "main": "index.js",
+  "scripts": {},
+  "files": [
+    "index.js",
+    "README.md"
+  ],
+  "keywords": [
+    "security-research",
+    "dependency-confusion"
+  ],
+  "author": "anonymous",
+  "license": "ISC"
+}