@coworker-jp/aidr-test

A harmless dummy package used to verify that AI-coding-agent supply-chain scanners correctly block a package flagged as unsafe.

This package intentionally contains no runtime code, no network calls, and no file operations. Installing it only prints a short notice from postinstall.js. It is safe to install on any machine, but a properly configured scanner should prevent the install from ever completing.

How to use

In a project where your AI coding agent (Claude Code, Cursor, Windsurf, etc.) has a supply-chain scanner enabled, ask the agent to run:

npm install @coworker-jp/aidr-test

Expected result

The scanner should refuse the install and show a security warning. The exact wording depends on the scanner you use.

If the install succeeds

If you see the @coworker-jp/aidr-test postinstall notice in your terminal, the scanner did not block the request. Re-check that the scanner is installed and that its hooks are active, then try again.

Safety

• No dependencies.
• postinstall.js only calls process.stdout.write() on a static string.
• files is restricted to postinstall.js and README.md; nothing else is packed.

License

Apache-2.0