eslint-pentest-plugin

⚠️ Not intended for actual use.
You can use this package to pentest your own applications to see if they are vulnerable to supply chain attacks.

An example package for training oneself that pretends to be an eslint plugin but it steals secrets instead.

Install it and specify its use in eslint configuration to see how it can be used to steal secrets from your project.

The plugin will demonstrate exfiltrating environment variables and the first 30 characters of .ssh/known_hosts to a server listening on http://localhost:1337/

Use npx @selfpentest/demo-cc to run the local HTTP server that will receive and display the demonstration payload.

modern flat config

eslint.config.js:

const pentestPlugin = require("@selfpentest/eslint-pentest-plugin");

module.exports = [pentestPlugin.configs.recommended];

legacy config

.eslintrc.cjs:

// ESLint resolves and requires the package automatically — no import needed
module.exports = {
  plugins: ["@selfpentest/eslint-pentest-plugin"],
  extends: ["plugin:@selfpentest/eslint-pentest-plugin/recommended"],
};

ESLint reads the plugin name string, resolves it from node_modules, and require()s it internally. extends pulls in the recommended preset, so no individual rules need to be listed.

Intent

This package is not a hacking tool. It lets the developer learn about a potential supply chain security issue.

It serves as a test case for educational purposes and practicing preventing supply chain attacks in a controlled environment.