@0xlr/dep-confusion-poc @0.0.1

Summary

Self-described dependency-confusion proof-of-concept targeting the @gojek/argus internal scope name. The package's postinstall hook only runs echo 'POC: Dependency confusion confirmed!' and index.js only emits console.log('@gojek/argus - installed via dependency confusion'); . There is no network I/O, no filesystem access, no credential reads, and no obfuscation. The risk is conceptual: if a Gojek build system is misconfigured, it could resolve this public package instead of an intended internal one, but no harmful payload executes on installers today. The author or a future version could replace the benign echo with an active payload, so the squat itself remains a namespace concern.

Source: amazon-inspector (15016319bdfd6f98a13cf4dcca7adad8ad4a97678bfaa77e2cb9b7068be0a435)