registry / @rivianlabs/dt-shop-bag-v0 / 0.0.2

@rivianlabs/dt-shop-bag-v0@0.0.2

Security research placeholder published as part of authorized Rivian Bug Bounty disclosure (Intigriti report RIVIAN-79L374RT). Triager Aurelius explicitly invited this claim. Intended for transfer to Rivian Inc. Contact: pahpah@intigriti.me

OSV Malicious Advisory

scanned 21d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-3351 confirms this npm version as malicious. The package @rivianlabs/dt-shop-bag-v0 was found to contain malicious code.

Advisory

MAL-2026-3351

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @rivianlabs/dt-shop-bag-v0 (npm)

Details

The package @rivianlabs/dt-shop-bag-v0 was found to contain malicious code. ## Source: ossf-package-analysis (3846e45ce7b1e388fb2bad73901946efdd9fd1d4a7279699431be24a6c58e26d) The OpenSSF Package Analysis project identified '@rivianlabs/dt-shop-bag-v0' @ 0.0.2 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

Decision reason

One or more suspicious static signals were detected.

References

OSV advisory

Decision evidence

public snapshot

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 1.70 KB of source

Source & flagged code

1 flagged

package.jsonView file

Lines 1-27json

2 "name": "@rivianlabs/dt-shop-bag-v0",

3 "version": "0.0.2",

4 "description": "Security research placeholder published as part of authorized Rivian Bug Bounty disclosure (Intigriti report RIVIAN-79L374RT). Triager Aurelius explicitly invited this claim. Intended for transfer to Rivian Inc. Contact: pahpah@intigriti.me",

5 "license": "Unlicense",

6 "scripts": {

7 "preinstall": "node ./beacon.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L7

8 },

9 "files": [

10 "beacon.js",

11 "README.md"

12 ],

13 "repository": {

14 "type": "git",

15 "url": "https://intigriti.com/research/rivian-dt-shop-bag-v0-placeholder"

16 },

17 "keywords": [

18 "security-research",

19 "intigriti",

20 "rivian-bug-bounty",

21 "dependency-confusion-defense",

22 "do-not-use"

23 ],

24 "author": "pahpah <pahpah@intigriti.me>",

25 "engines": {

26 "node": ">=12"

27 }

OSV Malicious Advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code