Dependency-confusion / namespace-squatting research probe published by the @larocas-bbresearch scope (bug-bounty research naming: 'tombstone-probe' / 'tp-probe' with random suffixes). Package contains no functional code -- only a README/package.json or a one-line module.exports string placeholder -- and no network callback code was found. Blocked under the researcher-test / PoC / dependency-confusion-probe policy: such packages exist to detect whether an organization's build system resolves an internal package name from the public registry, and installing one signals internal namespace details to the publisher. Packages were unpublished from npm shortly after publication; assessment is based on the complete first-publish Defender diff.