{"_id":"@gaia-codesearch/gaia-api-python","_rev":"10-75ba9c96f2c46715c1d660a0b5244940","name":"@gaia-codesearch/gaia-api-python","dist-tags":{"latest":"0.0.10"},"versions":{"0.0.4":{"name":"@gaia-codesearch/gaia-api-python","version":"0.0.4","author":{"name":"Security Researcher","email":"christos@pentestsec.com"},"license":"MIT","_id":"@gaia-codesearch/gaia-api-python@0.0.4","maintainers":[{"name":"papadope","email":"xristos8170@gmail.com"}],"dist":{"shasum":"b053fde2f441569dce9faf2c00673342f8b48711","tarball":"https://registry.npmjs.org/@gaia-codesearch/gaia-api-python/-/gaia-api-python-0.0.4.tgz","fileCount":4,"integrity":"sha512-ybpvzUjXrzPEY2zXqVBW9xmOC6FQS7RlTCBQi3Kga3oQ0OYWQLfHa87m9sTDUPhw2i2WBFBf5TivPdaqK1H3pg==","signatures":[{"sig":"MEYCIQDRXf1S43KUGS2jfqfkJw+5V+7L+FvvP+tVkBJpzy28+wIhAJTNBmFlL0cwg2CjWVSJfhd5GOp89wuvstTlAZ4g9/N3","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":3493},"main":"index.js","scripts":{"postinstall":"node postinstall.js"},"_npmUser":{"name":"papadope","email":"xristos8170@gmail.com"},"_npmVersion":"9.2.0","description":"Security research — scope ownership proof for dependency confusion report","directories":{},"_nodeVersion":"22.22.1","_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/gaia-api-python_0.0.4_1778231448558_0.13494477536299376","host":"s3://npm-registry-packages-npm-production"}},"0.0.5":{"name":"@gaia-codesearch/gaia-api-python","version":"0.0.5","author":{"name":"Security Researcher","email":"christos@pentestsec.com"},"license":"MIT","_id":"@gaia-codesearch/gaia-api-python@0.0.5","maintainers":[{"name":"papadope","email":"xristos8170@gmail.com"}],"dist":{"shasum":"e012335e01a6d5ec494f216b593f924c934b499c","tarball":"https://registry.npmjs.org/@gaia-codesearch/gaia-api-python/-/gaia-api-python-0.0.5.tgz","fileCount":4,"integrity":"sha512-dawrlx5u9J04Ble2V7TNITJ3HHZafpNYA6fagiIyPR2rkRaecMcZXd5a3xnf0ctsq0eXIDR5RXqLCvVQQiCx0A==","signatures":[{"sig":"MEUCICwaZ7cAqLQVxXUPc8Uz2KU3O48bK8HxjnXSJsqCFHUJAiEApb2RAL6ErvKw06S1YQ8Z9KlOM+9gfI8mOwM/V9eFitE=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":3342},"main":"index.js","scripts":{"postinstall":"node postinstall.js"},"_npmUser":{"name":"papadope","email":"xristos8170@gmail.com"},"_npmVersion":"9.2.0","description":"Security research — scope ownership proof for dependency confusion report","directories":{},"_nodeVersion":"22.22.1","_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/gaia-api-python_0.0.5_1778231881022_0.44009170900052497","host":"s3://npm-registry-packages-npm-production"}},"0.0.6":{"name":"@gaia-codesearch/gaia-api-python","version":"0.0.6","author":{"name":"Security Researcher","email":"christos@pentestsec.com"},"license":"MIT","_id":"@gaia-codesearch/gaia-api-python@0.0.6","maintainers":[{"name":"papadope","email":"xristos8170@gmail.com"}],"dist":{"shasum":"3bb0b1a35c944ce3fc2e5e7296930582fb7a15d0","tarball":"https://registry.npmjs.org/@gaia-codesearch/gaia-api-python/-/gaia-api-python-0.0.6.tgz","fileCount":4,"integrity":"sha512-/KB424RnUANVpfVhMxcqinowa5rpDZUYJGsgehFb+M6ydZ4u8CuaPM3S3Rv6RLs6PbDhmCe9MujX+kERyemQ2w==","signatures":[{"sig":"MEYCIQDjPmv784FI/mPVrZPZ50Sa9L6LNxAQzN6FyQyzZ8VU+wIhAJ7HDyM0kGF/M0PeaasOMLao+rhHHbw3nlAv1wf6CfMD","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":3342},"main":"index.js","scripts":{"postinstall":"node postinstall.js"},"_npmUser":{"name":"papadope","email":"xristos8170@gmail.com"},"_npmVersion":"9.2.0","description":"Security research — scope ownership proof for dependency confusion report","directories":{},"_nodeVersion":"22.22.1","_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/gaia-api-python_0.0.6_1778233394191_0.9582245949125818","host":"s3://npm-registry-packages-npm-production"}},"0.0.7":{"name":"@gaia-codesearch/gaia-api-python","version":"0.0.7","author":{"name":"Security Researcher","email":"christos@pentestsec.com"},"license":"MIT","_id":"@gaia-codesearch/gaia-api-python@0.0.7","maintainers":[{"name":"papadope","email":"xristos8170@gmail.com"}],"dist":{"shasum":"82b1bb0605765fdeea1d0b30e664d8bdac682bf6","tarball":"https://registry.npmjs.org/@gaia-codesearch/gaia-api-python/-/gaia-api-python-0.0.7.tgz","fileCount":4,"integrity":"sha512-XMuTHEhOKfnEtlrHaYZLXouao4PkD8gEHmFilE+unBV2XyrB3yMFtZZ6glbpx3v3BwnbD6EQzmVsUp9Ui+DynQ==","signatures":[{"sig":"MEQCIEf0vHegeCLJhiL9ivzrFMxU62dxL0griZgv2NlL63FtAiA73q2iw7FF/bcQSj72gDGcPGv1mGpNF7myMPS6AJ7Rqw==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":3345},"main":"index.js","scripts":{"postinstall":"node postinstall.js"},"_npmUser":{"name":"papadope","email":"xristos8170@gmail.com"},"_npmVersion":"9.2.0","description":"Security research — scope ownership proof for dependency confusion report","directories":{},"_nodeVersion":"22.22.1","_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/gaia-api-python_0.0.7_1778348297868_0.6414726332388965","host":"s3://npm-registry-packages-npm-production"}},"0.0.8":{"name":"@gaia-codesearch/gaia-api-python","version":"0.0.8","author":{"name":"Security Researcher","email":"christos@pentestsec.com"},"license":"MIT","_id":"@gaia-codesearch/gaia-api-python@0.0.8","maintainers":[{"name":"papadope","email":"xristos8170@gmail.com"}],"dist":{"shasum":"021f716965358009bb2ad02fb561c76454c10951","tarball":"https://registry.npmjs.org/@gaia-codesearch/gaia-api-python/-/gaia-api-python-0.0.8.tgz","fileCount":4,"integrity":"sha512-BZuGmu3LJTYjkEiC0Ej3lSwl5t29wCeUvMaILXfTxgknDjZ0bBw3xY8BsJdMXJKpzlP103Pxdw/S2hbzhzGxVA==","signatures":[{"sig":"MEUCIQCeeVxMy4q4SlKCteTbYvmgvNzVgfH+uxLJnke/uHfA2QIgBUCrIL+14+2t0x/ienjWNvYlbwedubco2+hbngR68+Q=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":3341},"main":"index.js","scripts":{"postinstall":"node postinstall.js"},"_npmUser":{"name":"papadope","email":"xristos8170@gmail.com"},"_npmVersion":"9.2.0","description":"Security research — scope ownership proof for dependency confusion report","directories":{},"_nodeVersion":"22.22.1","_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/gaia-api-python_0.0.8_1778348629015_0.056836982729692176","host":"s3://npm-registry-packages-npm-production"}},"0.0.9":{"name":"@gaia-codesearch/gaia-api-python","version":"0.0.9","author":{"name":"Security Researcher","email":"christos@pentestsec.com"},"license":"MIT","_id":"@gaia-codesearch/gaia-api-python@0.0.9","maintainers":[{"name":"papadope","email":"xristos8170@gmail.com"}],"dist":{"shasum":"8a690c4247141858cd10c6bece1d07a767b5f436","tarball":"https://registry.npmjs.org/@gaia-codesearch/gaia-api-python/-/gaia-api-python-0.0.9.tgz","fileCount":4,"integrity":"sha512-TG7MosnLM9IyT/t8tU3xkMZjWiP46t8AKzIcG8xmQ2kE+/sE1C9Za/tGOK3hEVbthEo5w6/q+2mvvMoXLvWcbQ==","signatures":[{"sig":"MEUCIQCgVU45q6fYqJU0j410e1wOqvnHUeoesnfN1ErrSxHUgAIgLZzIxaqlKXn2U78Fjbzdy/eAuB7vKX5HIOrX7Wxrn1k=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":3056},"main":"index.js","scripts":{"postinstall":"node postinstall.js"},"_npmUser":{"name":"papadope","email":"xristos8170@gmail.com"},"_npmVersion":"9.2.0","description":"Security research — scope ownership proof for dependency confusion report","directories":{},"_nodeVersion":"22.22.1","_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/gaia-api-python_0.0.9_1778349027807_0.24182284428791423","host":"s3://npm-registry-packages-npm-production"}},"0.0.10":{"name":"@gaia-codesearch/gaia-api-python","version":"0.0.10","description":"Security research — scope ownership proof for dependency confusion report","main":"index.js","scripts":{"postinstall":"node postinstall.js"},"author":{"name":"Security Researcher","email":"christos@pentestsec.com"},"license":"MIT","_id":"@gaia-codesearch/gaia-api-python@0.0.10","_nodeVersion":"22.22.1","_npmVersion":"9.2.0","dist":{"integrity":"sha512-h3K9ZwsLbtXen+CcB6qT2LOH4CllOVtDNqfZo5UkpZXNYNhS0/yMK+mLHlnyzvE4lzKM9GQXDdcm7FuzLaECtw==","shasum":"74ce9e353a51d8d3634bd209e2d032fda880f953","tarball":"https://registry.npmjs.org/@gaia-codesearch/gaia-api-python/-/gaia-api-python-0.0.10.tgz","fileCount":4,"unpackedSize":2957,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEUCIQC1v8obrZwM4LJQ+BRdiSu2chL0uhmrNxuTEUXOxtMwSwIgFcpXInBoiwssvjly922L5JF6b6Ie8FnJd2XAnyeRiWg="}]},"_npmUser":{"name":"papadope","email":"xristos8170@gmail.com"},"directories":{},"maintainers":[{"name":"papadope","email":"xristos8170@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/gaia-api-python_0.0.10_1778436729621_0.15936323554140785"},"_hasShrinkwrap":false}},"time":{"created":"2026-05-08T09:10:48.396Z","modified":"2026-05-10T18:12:09.887Z","0.0.3-ci-main-20230824.2":"2026-05-08T09:06:06.417Z","0.0.4":"2026-05-08T09:10:48.694Z","0.0.5":"2026-05-08T09:18:01.169Z","0.0.6":"2026-05-08T09:43:14.371Z","0.0.7":"2026-05-09T17:38:18.002Z","0.0.8":"2026-05-09T17:43:49.143Z","0.0.9":"2026-05-09T17:50:27.941Z","0.0.10":"2026-05-10T18:12:09.763Z"},"author":{"name":"Security Researcher","email":"christos@pentestsec.com"},"license":"MIT","description":"Security research — scope ownership proof for dependency confusion report","maintainers":[{"name":"papadope","email":"xristos8170@gmail.com"}],"readme":"# @gaia-codesearch/gaia-api-python — Dependency Confusion PoC\n\n## Summary\n\nThis package is a **security research proof-of-concept** demonstrating a dependency confusion vulnerability in Microsoft's VS Code extension **IntelliCode API Usage Examples** (46M+ installs).\n\nThe `@gaia-codesearch` npm scope was unregistered while the extension's `package.json` depended on:\n\n- `@gaia-codesearch/gaia-api-python: 0.0.3-ci-main-20230824.2`\n- `@gaia-codesearch/gaia-api-typescript: 0.0.3-ci-main-20230824.2`\n\nAn attacker could have registered this scope and published malicious packages that execute code during `npm install` of the extension source.\n\n## Impact\n\n- **Extension:** `VisualStudioExptTeam.intellicode-api-usage-examples`\n- **Installs:** 46,002,431\n- **Publisher:** Microsoft (VisualStudioExptTeam)\n- **Attack:** Any developer or CI pipeline cloning and building the extension from source would execute attacker-controlled code via the `preinstall` script.\n\n## This PoC\n\nThis package only prints a message to the console. No data is exfiltrated, no files are modified, no network connections are made. It demonstrates that code execution is possible during `npm install`.\n\n## Contact\n\nResearcher: christos@pentestsec.com\n","readmeFilename":"README.md"}