registry / @miurba/alcazaba / 99.99.99

@miurba/alcazaba@99.99.99

SECURITY RESEARCH PLACEHOLDER — Reserved by Secur0 researcher ariverapoblet to demonstrate dependency-confusion exposure in miUrba (Alcazaba Beach SPA references @miurba/alcazaba). NOT for public consumption. Please contact security@miurba.com or via Secu

OSV Malicious Advisory

scanned 21d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-3410 confirms this npm version as malicious. The package @miurba/alcazaba was found to contain malicious code.

Advisory

MAL-2026-3410

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @miurba/alcazaba (npm)

Details

The package @miurba/alcazaba was found to contain malicious code. ## Source: ossf-package-analysis (50365d8256527fa5afa757d8d15674e861bec80afcd6517d018e329f3e4fa93f) The OpenSSF Package Analysis project identified '@miurba/alcazaba' @ 99.99.99 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

Decision reason

One or more suspicious static signals were detected.

References

OSV advisory

Decision evidence

public snapshot

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 2.61 KB of source

Source & flagged code

3 flagged

package.jsonView file

Lines 1-19json

2 "name": "@miurba/alcazaba",

3 "version": "99.99.99",

4 "description": "SECURITY RESEARCH PLACEHOLDER — Reserved by Secur0 researcher ariverapoblet to demonstrate dependency-confusion exposure in miUrba (Alcazaba Beach SPA references @miurba/alcazaba). NOT for public consumption. Please contact security@miurba.com or via Secur0 to coordinate scope reservation. This package only performs an outbound DNS/HTTP lookup to a Burp Collaborator instance owned by the researcher; no data is collected beyond the fact that an install occurred plus the hostname/username of the runner. Will be unpublished/transferred upon contact.",

5 "main": "index.js",

6 "scripts": {

7 "preinstall": "node phone-home.js preinstall || exit 0",

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L7

8 "postinstall": "node phone-home.js postinstall || exit 0"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L8

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L8

9 },

10 "keywords": ["security-research", "dependency-confusion", "miurba", "secur0", "placeholder"],

11 "author": "ariverapoblet (Secur0)",

12 "license": "ISC",

13 "homepage": "https://secur0.com",

14 "repository": {

15 "type": "git",

16 "url": "https://github.com/security-research/miurba-depconf-poc"

17 }

18}

OSV Malicious Advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code