@test-lab-unsafe/evil-dep

WARNING: SECURITY RESEARCH / CTF LAB PACKAGE — DO NOT USE IN PRODUCTION

This package is part of a supply-chain attack demonstration lab. It is intentionally malicious for educational purposes.

What it does

When installed (as a transitive/indirect dependency), the postinstall script runs automatically and:

1. Collects fake hardcoded AWS-style credentials + system metadata
2. Encodes them as base64
3. Silently exfiltrates them via curl to example.com
4. Fails silently so the install appears to succeed normally

Why this exists

This lab demonstrates how:

• A developer installs a safe-looking direct dependency (@test-lab-unsafe/safe-dep)
• That dependency pulls in this package as an indirect dependency
• The developer never audits the transitive dep tree
• postinstall scripts run automatically on npm install
• Credentials are stolen at install time, before any code is executed

Attack chain

Your project
  └── @test-lab-unsafe/safe-dep  (direct dep — looks clean)
        └── @test-lab-unsafe/evil-dep  (YOU NEVER SEE THIS)
              └── postinstall.js  →  curl example.com (exfiltration)

Mitigation

• Run npm install --ignore-scripts to disable postinstall scripts
• Use npm audit and socket.dev to scan transitive deps
• Review all scripts.postinstall entries in your full dep tree

This package is for authorized security research and CTF/demo use only.