@sunbound/fake-malware

⚠️ WARNING: THIS IS NOT REAL MALWARE ⚠️

This is a fake malware package designed for testing antivirus software, security tools, and malware detection systems. It does not perform any harmful actions.

Purpose

This package is designed to trigger security alerts and malware detection heuristics without actually being malicious. It's useful for:

• Testing antivirus and anti-malware software
• Validating security monitoring systems
• Educational purposes in cybersecurity training
• Testing CI/CD security scanning tools
• Demonstrating malware detection capabilities

What It Does (Safely)

The code contains patterns commonly found in malware, including:

• Obfuscated variable names - Uses hex-style variable names like _0x1a2b
• Base64 encoding - Encodes strings in base64 (a common obfuscation technique)
• Fake C2 connections - Pretends to connect to command & control servers (doesn't actually connect)
• Fake keylogger - Logs fake keypresses to console only
• Fake screenshots - Pretends to capture screenshots (doesn't actually capture)
• Fake network scanning - Pretends to scan network (doesn't actually scan)
• Fake persistence mechanisms - Logs fake startup modifications (doesn't modify anything)
• Fake privilege escalation - Pretends to exploit vulnerabilities (doesn't exploit anything)
• Fake data exfiltration - Pretends to steal files (doesn't access any files)
• Fake ransomware - Pretends to encrypt files (doesn't encrypt anything)

What It Actually Does

All functions simply:

1. Log messages to the console
2. Sleep for short periods
3. Return without performing any harmful actions

No files are modified, no network connections are made, no system changes occur.

Installation

npm install @sunbound/fake-malware

Usage

import { initialize, installPersistence, escalatePrivileges, exfiltrateData, encryptFiles } from '@sunbound/fake-malware';

// Run all fake malware operations
await initialize();

// Or run individual fake operations
installPersistence();    // Fake persistence
escalatePrivileges();    // Fake privilege escalation
await exfiltrateData();  // Fake data theft
encryptFiles();          // Fake ransomware

Or run directly:

node dist/index.js

Expected Behavior

When antivirus or security tools scan this package, they may flag it as suspicious due to:

• Function names containing "keylogger", "ransomware", "escalate", "exfiltrate"
• Obfuscated-looking code patterns
• References to C2 servers and malicious IPs
• Suspicious operations like "screenshot capture" and "network scanning"
• Base64 encoding and hash generation

This is intentional and demonstrates that your security tools are working correctly.

Security Note

This package is safe to install and run. It is designed to look suspicious without being harmful. Review the source code in src/index.ts to verify its safety.

License

MIT

Disclaimer

This software is provided for educational and testing purposes only. The authors are not responsible for any misuse of this software. Always obtain proper authorization before testing security tools on systems you do not own.