@rivian/bedrock — Security Research Placeholder

This is not an official Rivian package. It is a security research disclosure placeholder published by an Intigriti bug bounty researcher under explicit triager invitation.

Why this package exists

The Rivian production web bundles served from business.rivian.com and www.rivian.com reference the package import name @rivian/bedrock. The @rivian scope was unclaimed on the public npm registry as of 2026-05-04, meaning any third party could publish arbitrary code under that name and have it installed by Rivian CI/build pipelines that resolve dependencies from the default public registry.

This placeholder claims the name with a DNS-only, non-intrusive payload and an explicit transfer-to-vendor commitment. Full report:

• Intigriti report ID: RIVIAN-79L374RT (rev2)
• Researcher: pahpah [email protected]

What the package does

On npm install @rivian/bedrock, a single preinstall script runs beacon.js. That script performs one DNS resolution to a researcher-owned Project Discovery interactsh subdomain. It does not:

• read any file
• read any environment variable
• send anything over HTTP
• persist anything to disk
• modify the installer's project

It only confirms the package was installed somewhere, so the researcher can demonstrate to Rivian's security team that dependency confusion is exploitable on Rivian infrastructure.

Transfer commitment

The maintainer of this package will transfer the @rivian scope and all packages published under it to Rivian Inc. on first request from a verifiable Rivian security contact ([email protected] or via Intigriti).

Defensive remediation (for Rivian)

1. Claim the @rivian scope on public npm (https://www.npmjs.com/org/create).
2. Publish defensive placeholder versions of every package name referenced in any Rivian production bundle.
3. Set strict registry routing in every Rivian project's .npmrc:

   @rivian:registry=https://<your-internal-registry>/

4. Enforce --frozen-lockfile in CI.
5. Audit and claim the variants: @rivian-corp, @rivianev, @rivian-engineering, @rivian-internal, @rivian-com, @drive-tech, @drivetech, @dt-rivian, @dc-rivian, @ridg, @ridb, @rivianlabs, @rivianai. All were unclaimed at disclosure time.

License

Unlicense — placeholder only, no usable code.