@rivian/eux — security research PoC

This package is a proof-of-concept for a dependency confusion finding submitted to Rivian via the Intigriti bug-bounty program.

Why this exists

Rivian's production bundle at legacy.basecamp.rivian.com/remoteEntry.js references the package name @rivian/eux. The @rivian scope on the public npm registry is unclaimed (404). An attacker who claims the scope and publishes a package at any version higher than the internal 0.112.1-hotfix.1 will be silently preferred by any build pipeline whose .npmrc does not pin @rivian to Rivian's private registry.

Initial Intigriti report 2026-05-02 was marked Informative on 2026-05-04 with the explicit invitation: "If you can claim the package and provide evidence of interactions from Rivian-owned systems, please open a new report."

This package is the response to that invitation.

What this package does

The postinstall script performs a single DNS lookup to a unique callback subdomain so the researcher can correlate which install sites fetched the package. The encoded subdomain contains hostname, platform and timestamp, nothing else.

It does not:

• Make HTTP requests
• Read or write files
• Spawn child processes
• Read environment variables or credentials
• Persist anything on disk
• Download or execute any second-stage payload

The full source is postinstall.js (~25 lines).

After evidence collection

This package will be:

1. Unpublished (npm unpublish --force @rivian/eux) once Rivian confirms they will register the @rivian org themselves, OR
2. Transferred to Rivian's npm org if they prefer to take it over.

Contact

• Researcher: pahpah (Intigriti)
• Email: [email protected] / [email protected]
• Intigriti report: linked from the new submission

Recommendation to Rivian

Register the @rivian org on npm (free tier sufficient) and publish placeholder packages for at least:

@rivian/eux, @rivian/dt-lib-lumberjack, @rivian/legacy, @rivian/ui, @rivian/shell, @rivian/components, @rivian/utils, @rivian/auth, @rivian/api.

Then pin @rivian to your private registry in every .npmrc across CI runners, developer workstations and monorepos.