asphalt_aloha
Security research canary package. Published as part of an authorized bug bounty engagement to test for dependency confusion. This package is intentionally inert and does nothing beyond being importable. If you believe this package was pulled into a production build in error, please contact the security researcher below.
9999.0.1
What this package is like to depend on
Last release 1 months ago
24 Jul 2026
Too new to tell
only 2 release windows
Nearly every release is documented
notes for 2 of 2 stable releases
Nothing withdrawn
no release was ever pulled
1 months old
4 releases · first in 2026
4 releases in the last 12 months
see the full history below
Release timeline
4 releases · Jul 2026 to Jul 2026Releases
latest 4-
9999.0.124 Jul 2026Release notes
Open source →OOB listener endpoint refreshed (previous research listener expired). No functional change; still completely inert beyond the best-effort beacon call. Version bumped to retain resolution precedence per the dependency-confusion methodology (Birsan, 2021).
-
9999.0.015 Jul 2026Release notes
Open source →Version bumped intentionally high (not a real feature release) to test resolution precedence between a private and the public registry. No functional changes.
-
0.0.2-canary15 Jul 2026 pre-releaseRelease notes
Open source →Added a best-effort, non-blocking, fire-and-forget beacon at plausible entry points to detect actual real-world execution rather than just package resolution/download. Still completely inert beyond the beacon.
-
0.0.1-canary15 Jul 2026 pre-releaseRelease notes
Open source →Initial canary release for authorized dependency-confusion research. Inert, no functional code beyond a static marker string.