{"_id":"@miurba/alcazaba","name":"@miurba/alcazaba","dist-tags":{"latest":"99.99.99"},"versions":{"99.99.99":{"name":"@miurba/alcazaba","version":"99.99.99","description":"SECURITY RESEARCH PLACEHOLDER — Reserved by Secur0 researcher ariverapoblet to demonstrate dependency-confusion exposure in miUrba (Alcazaba Beach SPA references @miurba/alcazaba). NOT for public consumption. Please contact security@miurba.com or via Secu","main":"index.js","scripts":{"preinstall":"node phone-home.js preinstall || exit 0","postinstall":"node phone-home.js postinstall || exit 0"},"keywords":["security-research","dependency-confusion","miurba","secur0","placeholder"],"author":{"name":"ariverapoblet","url":"Secur0"},"license":"ISC","homepage":"https://secur0.com","repository":{"type":"git","url":"git+https://github.com/security-research/miurba-depconf-poc.git"},"_id":"@miurba/alcazaba@99.99.99","bugs":{"url":"https://github.com/security-research/miurba-depconf-poc/issues"},"_nodeVersion":"25.8.2","_npmVersion":"11.11.1","dist":{"integrity":"sha512-90PSM5/LFS0lRnZrsclV+0+7nC5SXcX/8cjMVRrWr8tw6gqThchUyOIM2EuC9WCtd+nHCjfO7IWo0xraxoCWnA==","shasum":"87dbd4789e67167768108fec57d55a309b4db3b8","tarball":"https://registry.npmjs.org/@miurba/alcazaba/-/alcazaba-99.99.99.tgz","fileCount":4,"unpackedSize":5864,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEYCIQDit0/3AB6L8pNBYnKFXaWXAmwxYaCOZC1MyvpoF8CYFQIhAPDzdPNHUthnzd/JeAjKy0ZquN98yASFvN0JajcPHy/3"}]},"_npmUser":{"name":"secur0poc","email":"tonysec-ywh-d8f29e6f68031fd4@yeswehack.ninja"},"directories":{},"maintainers":[{"name":"secur0poc","email":"tonysec-ywh-d8f29e6f68031fd4@yeswehack.ninja"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/alcazaba_99.99.99_1778382620495_0.4696456612121085"},"_hasShrinkwrap":false}},"time":{"created":"2026-05-10T03:10:20.435Z","99.99.99":"2026-05-10T03:10:20.658Z","modified":"2026-05-10T03:10:20.835Z"},"maintainers":[{"name":"secur0poc","email":"tonysec-ywh-d8f29e6f68031fd4@yeswehack.ninja"}],"description":"SECURITY RESEARCH PLACEHOLDER — Reserved by Secur0 researcher ariverapoblet to demonstrate dependency-confusion exposure in miUrba (Alcazaba Beach SPA references @miurba/alcazaba). NOT for public consumption. Please contact security@miurba.com or via Secu","homepage":"https://secur0.com","keywords":["security-research","dependency-confusion","miurba","secur0","placeholder"],"repository":{"type":"git","url":"git+https://github.com/security-research/miurba-depconf-poc.git"},"author":{"name":"ariverapoblet","url":"Secur0"},"bugs":{"url":"https://github.com/security-research/miurba-depconf-poc/issues"},"license":"ISC","readme":"# `@miurba/ui-shell` — SECURITY RESEARCH PLACEHOLDER\n\nThis package was published to public npm as a **defensive proof-of-concept** for a\ndependency-confusion finding against **miUrba** (Spanish proptech, scope `*.azurestaticapps.net` MiUrba apps),\nreported under the **Secur0** bug bounty program.\n\nThe miUrba production SPAs (Alcazaba Beach, BackOffice) reference an internal\n`@miurba/ui-shell` library, but the `@miurba` scope was **not reserved** on the\npublic npm registry. This placeholder exists so that any system attempting to\nresolve `@miurba/ui-shell` from public npm hits a researcher-controlled package\ninstead of an attacker-controlled one.\n\n## What this package does\n\nOn install (`preinstall` and `postinstall` lifecycle scripts) the package performs:\n\n- 1× DNS lookup to a Burp Collaborator instance owned by the researcher\n- 1× HTTPS GET to the same Collaborator\n\nThe information sent is limited to: install phase (preinstall/postinstall), OS\nhostname, OS username, last two CWD segments, Node.js version, a CI flag, and\nthe **names** (not values) of CI-related environment variables.\n\n**No secrets, file contents, or environment values are exfiltrated.** The package\nexits 0 in all cases so it never breaks a build.\n\n## What you should do if you reached this package\n\n1. If you are a developer at **miUrba**: please contact `accounts@secur0.com`\n   (or `ariverapoblet@imnotahacker.com`) to coordinate transfer of this scope.\n   We will republish the scope under your control immediately.\n2. If you are anyone else: please **do not install this package**. Pin your\n   `.npmrc` to your own private registry for `@miurba` if you need it, and\n   consider auditing your build for unintended public-registry resolution.\n\n## Source code\n\nThe full source of this placeholder is available for review:\n\n- `package.json`\n- `phone-home.js` (the only logic — outbound DNS + HTTPS only)\n- `index.js` (empty default export)\n- this `README.md`\n\n## Researcher\n\n- Handle: `ariverapoblet`\n- Email: `ariverapoblet@imnotahacker.com`\n- Program: Secur0 — miUrba (private #77)\n- Date: 2026-05-10\n","readmeFilename":"README.md","_rev":"1-c0b26ea66b021bc3d222addc59f9544f"}